libosdp 3.2.3__tar.gz → 3.2.5__tar.gz

{libosdp-3.2.3 → libosdp-3.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: libosdp
-Version: 3.2.3
+Version: 3.2.5
 Summary: Library implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol)
 Home-page: https://github.com/goToMain/libosdp
 Author: Siddharth Chandrasekaran

{libosdp-3.2.3 → libosdp-3.2.5}/libosdp.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: libosdp
-Version: 3.2.3
+Version: 3.2.5
 Summary: Library implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol)
 Home-page: https://github.com/goToMain/libosdp
 Author: Siddharth Chandrasekaran

{libosdp-3.2.3 → libosdp-3.2.5}/setup.py

@@ -12,7 +12,7 @@ import shutil
 import subprocess
 
 project_name = "libosdp"
-project_version = "3.2.3"
+project_version = "3.2.5"
 current_dir = os.path.dirname(os.path.realpath(__file__))
 repo_root = os.path.realpath(os.path.join(current_dir, ".."))
 

{libosdp-3.2.3 → libosdp-3.2.5}/vendor/src/osdp_config.h

@@ -11,11 +11,11 @@
  * @brief The following macros are defined defined from the variable in cmake
  * files. All @XXX@ are replaced by the value of XXX as resolved by cmake.
  */
-#define PROJECT_VERSION                "3.2.3"
+#define PROJECT_VERSION                "3.2.5"
 #define PROJECT_NAME                   "libosdp"
-#define GIT_BRANCH                     "release_v3.2"
-#define GIT_REV                        "a4079c9"
-#define GIT_TAG                        ""
+#define GIT_BRANCH                     "detached"
+#define GIT_REV                        "v3.2.5-0-gdc4b8da"
+#define GIT_TAG                        "v3.2.5"
 #define GIT_DIFF                       ""
 #define REPO_ROOT                      "/home/runner/work/libosdp/libosdp"
 

{libosdp-3.2.3 → libosdp-3.2.5}/vendor/src/osdp_cp.c

@@ -573,7 +573,8 @@ static int cp_decode_response(struct osdp_pd *pd, uint8_t *buf, int len)
 		event.type = OSDP_EVENT_KEYPRESS;
 		event.keypress.reader_no = buf[pos++];
 		event.keypress.length = buf[pos++];
-		if ((len - REPLY_KEYPAD_DATA_LEN) != event.keypress.length) {
+		if (event.keypress.length != (len - REPLY_KEYPAD_DATA_LEN) ||
+		    event.keypress.length > OSDP_EVENT_KEYPRESS_MAX_DATALEN) {
 			break;
 		}
 		memcpy(event.keypress.data, buf + pos, event.keypress.length);
@@ -591,7 +592,8 @@ static int cp_decode_response(struct osdp_pd *pd, uint8_t *buf, int len)
 		event.cardread.length = bread_u16_le(buf, &pos);
 		event.cardread.direction = 0; /* un-specified */
 		t = (event.cardread.length + 7) / 8; /* len: bytes */
-		if (t != (len - REPLY_RAW_DATA_LEN)) {
+		if (t != (len - REPLY_RAW_DATA_LEN) ||
+		    t > OSDP_EVENT_CARDREAD_MAX_DATALEN) {
 			break;
 		}
 		memcpy(event.cardread.data, buf + pos, t);

{libosdp-3.2.3 → libosdp-3.2.5}/vendor/src/osdp_file.c

@@ -218,7 +218,12 @@ int osdp_file_cmd_tx_decode(struct osdp_pd *pd, uint8_t *buf, int len)
 	xfer.offset = bread_u32_le(buf, &pos);
 	xfer.length = bread_u16_le(buf, &pos);
 	assert(pos == sizeof(struct osdp_cmd_file_xfer));
-	assert(xfer.length + pos == len);
+
+	if (xfer.length > (uint16_t)(len - FILE_TRANSFER_HEADER_SIZE)) {
+		LOG_ERR("TX_Decode: declared length %d exceeds %d bytes present",
+			xfer.length, len - FILE_TRANSFER_HEADER_SIZE);
+		return -1;
+	}
 
 	if (f->state == OSDP_FILE_IDLE || f->state == OSDP_FILE_DONE) {
 		if (pd->command_callback) {
@@ -253,6 +258,15 @@ int osdp_file_cmd_tx_decode(struct osdp_pd *pd, uint8_t *buf, int len)
 		return -1;
 	}
 
+	/* Bound the wire offset and length against the declared file size
+	 * before handing them to the write handler, so a peer cannot make it
+	 * write outside the file it announced. */
+	if ((uint64_t)xfer.offset + xfer.length > f->size) {
+		LOG_ERR("TX_Decode: chunk off:%d len:%d exceeds size:%d",
+			xfer.offset, xfer.length, f->size);
+		return -1;
+	}
+
 	f->length = f->ops.write(f->ops.arg, data, xfer.length, xfer.offset);
 	if (f->length != xfer.length) {
 		LOG_ERR("TX_Decode: user write failed! rc:%d len:%d off:%d",
@@ -296,7 +310,13 @@ int osdp_file_cmd_stat_build(struct osdp_pd *pd, uint8_t *buf, int max_len)
 	}
 	LOG_DBG("length: %d offset: %d size: %d", f->length, f->offset, f->size);
 	f->length = 0;
-	assert(f->offset <= f->size);
+
+	/*
+	 * Don't assert f->offset:w <= f->size: a legitimately retransmitted
+	 * chunk (lost FTSTAT) re-drives the running offset and can transiently
+	 * overshoot. The write-side bound in tx_decode is the real guard.
+	 */
+
 	if (f->offset == f->size) { /* EOF */
 		if (f->ops.close(f->ops.arg) < 0) {
 			LOG_ERR("Stat_Build: Close failed!");

{libosdp-3.2.3 → libosdp-3.2.5}/vendor/src/osdp_phy.c

@@ -466,6 +466,7 @@ static bool phy_rescan_packet_buf(struct osdp_pd *pd)
 static int phy_check_header(struct osdp_pd *pd)
 {
 	int ret, len;
+	unsigned long need;
 	uint8_t cur_byte = 0, prev_byte = 0;
 	uint8_t *buf = pd->packet_buf;
 
@@ -491,10 +492,19 @@ static int phy_check_header(struct osdp_pd *pd)
 		prev_byte = cur_byte;
 	}
 
-	/* Found start of a new packet; wait until we have atleast the header */
-	len = osdp_rb_pop_buf(pd->rx.rb, buf + pd->packet_buf_len,
-			      sizeof(struct osdp_packet_header) - 1);
-	pd->packet_buf_len += len;
+	/*
+	 * Found start of a new packet; top up only the header bytes still
+	 * missing. On re-entry with a partially collected header, popping a
+	 * fixed sizeof(header)-1 bytes would overshoot packet_buf_len past the
+	 * packet and wedge the framer (see osdp_phy_check_packet()).
+	 */
+	need = sizeof(struct osdp_packet_header) +
+	       (buf[0] == OSDP_PKT_MARK ? 1 : 0);
+	if (pd->packet_buf_len < need) {
+		len = osdp_rb_pop_buf(pd->rx.rb, buf + pd->packet_buf_len,
+				      need - pd->packet_buf_len);
+		pd->packet_buf_len += len;
+	}
 
 	/* Validate header using shared function */
 	ret = phy_validate_header(pd, buf, pd->packet_buf_len, OSDP_PACKET_BUF_SIZE);
@@ -672,6 +682,17 @@ int osdp_phy_check_packet(struct osdp_pd *pd)
 	}
 
 	if (!zero_copy) {
+		/*
+		 * Guard the unsigned subtraction below: if we ever hold more
+		 * bytes than the header declared, the wrap-around would ask for
+		 * a huge (negative when cast to int) count and wedge the framer.
+		 * Treat it as a malformed frame so the link resets and recovers.
+		 */
+		if (pd->packet_buf_len > pd->packet_len) {
+			LOG_ERR("Buffered %lu bytes exceeds packet length %lu",
+				pd->packet_buf_len, pd->packet_len);
+			return OSDP_ERR_PKT_FMT;
+		}
 		/* Traditional: collect remaining packet bytes from ring buffer */
 		ret = osdp_rb_pop_buf(pd->rx.rb,
 				      pd->packet_buf + pd->packet_buf_len,