From a76fbd4aa389f098a2f7d39427b114120c1ed1e9 Mon Sep 17 00:00:00 2001 From: Boris Zbarsky Date: Fri, 22 Oct 2021 14:18:41 -0400 Subject: [PATCH] Enforce spec limit on the location in OTA QueryImage. (#10786) * Enforce spec limit on the location in OTA QueryImage. Fixes https://github.com/project-chip/connectedhomeip/issues/7112 Also fixes missing return if the metadata size was wrong, which would lead to us trying to process the command anyway. * Update src/app/clusters/ota-provider/ota-provider.cpp Co-authored-by: Trevor Holbrook Co-authored-by: Trevor Holbrook --- src/app/clusters/ota-provider/ota-provider.cpp | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/app/clusters/ota-provider/ota-provider.cpp b/src/app/clusters/ota-provider/ota-provider.cpp index 724090aabd2807..a3cb9b8215f51b 100644 --- a/src/app/clusters/ota-provider/ota-provider.cpp +++ b/src/app/clusters/ota-provider/ota-provider.cpp @@ -38,6 +38,7 @@ using namespace chip::app::Clusters::OtaSoftwareUpdateProvider; using chip::app::Clusters::OTAProviderDelegate; namespace { +constexpr size_t kLocationLen = 2; // The expected length of the location parameter in QueryImage constexpr size_t kMaxMetadataLen = 512; // The maximum length of Metadata in any OTA Provider command constexpr size_t kUpdateTokenMaxLength = 32; // The expected length of the Update Token parameter used in multiple commands constexpr size_t kUpdateTokenMinLength = 8; // The expected length of the Update Token parameter used in multiple commands @@ -174,6 +175,7 @@ bool emberAfOtaSoftwareUpdateProviderClusterQueryImageCallback(app::CommandHandl auto & hardwareVersion = commandData.hardwareVersion; auto & softwareVersion = commandData.softwareVersion; auto & protocolsSupported = commandData.protocolsSupported; + auto & location = commandData.location; auto & requestorCanConsent = commandData.requestorCanConsent; auto & metadataForProvider = commandData.metadataForProvider; @@ -189,14 +191,22 @@ bool emberAfOtaSoftwareUpdateProviderClusterQueryImageCallback(app::CommandHandl ChipLogDetail(Zcl, "OTA Provider received QueryImage"); + if (location.size() != kLocationLen) + { + ChipLogError(Zcl, "location param length %zu != expected length %zu", location.size(), kLocationLen); + emberAfSendImmediateDefaultResponse(EMBER_ZCL_STATUS_INVALID_ARGUMENT); + return true; + } + if (metadataForProvider.size() > kMaxMetadataLen) { ChipLogError(Zcl, "metadata size %zu exceeds max %zu", metadataForProvider.size(), kMaxMetadataLen); emberAfSendImmediateDefaultResponse(EMBER_ZCL_STATUS_INVALID_ARGUMENT); + return true; } status = delegate->HandleQueryImage(commandObj, vendorId, productId, hardwareVersion, softwareVersion, protocolsSupported, - commandData.location, requestorCanConsent, metadataForProvider); + location, requestorCanConsent, metadataForProvider); if (status != EMBER_ZCL_STATUS_SUCCESS) { emberAfSendImmediateDefaultResponse(status);