Changeset 11124 in ntrip for trunk/BNC/src

Timestamp:

Oct 24, 2026, 10:10:29 PM (13 days ago)

Author:

stuerze

Message:

Some fixes regarding memory corruption from stream data, credential exposure,

Location:

trunk/BNC/src

Files:

• RTCM3/RTCM3Decoder.cpp (modified) (1 diff)
• RTCM3/clock_and_orbit/clock_orbit.h (modified) (1 diff)
• RTCM3/clock_and_orbit/clock_orbit_rtcm_new.cpp (modified) (2 diffs)
• RTCM3/crs.h (modified) (5 diffs)
• bncnetqueryrtp.cpp (modified) (6 diffs)
• bncnetqueryv1.cpp (modified) (1 diff)
• upload/bncrtnetuploadcaster.cpp (modified) (1 diff)

trunk/BNC/src/RTCM3/RTCM3Decoder.cpp

@@ -2173 +2173 @@
     for (int i = 0; i < dblinksnum; i++) {
       int dblinknum = -1;
-      char dblinkname[31];
+      char dblinkname[32]; // up to 31 characters (5-bit length) + terminating 0
       GETBITS(dblinknum, 5)
       if (dblinknum > -1 && dblinknum <= 31) {

trunk/BNC/src/RTCM3/clock_and_orbit/clock_orbit.h

@@ -454 +454 @@
       unsigned int Degree; /* 1-16 */
       unsigned int Order;  /* 1-16 */
-      double Sinus[VTEC_MAXIONODEGREE][VTEC_MAXIONOORDER];
-      double Cosinus[VTEC_MAXIONODEGREE][VTEC_MAXIONOORDER];
+      /* indices 0 .. Degree / 0 .. Order, both up to 16 */
+      double Sinus[VTEC_MAXIONODEGREE+1][VTEC_MAXIONOORDER+1];
+      double Cosinus[VTEC_MAXIONODEGREE+1][VTEC_MAXIONOORDER+1];
     } Layers[VTEC_NUMIONOLAYERS];
   };

trunk/BNC/src/RTCM3/clock_and_orbit/clock_orbit_rtcm_new.cpp

@@ -637 +637 @@
       fprintf(stderr, "ssrIod %d providerId %d solId %d numEntries %d \n",
       md->SSRIOD, md->SSRProviderID, md->SSRSolutionID, md->NumEntries);
-#endif 
+#endif
+    if (md->NumEntries > META_MAXNUMENTRIES) { /* DF+063 is 5 bits wide */
+      md->NumEntries = 0;
+      return GCOBR_DATAMISMATCH;
+    }
     for (i = 0; i < md->NumEntries; i++) {
       unsigned int additionalBits;
@@ -687 +691 @@
       if (md->Entries[i].nonDefaultIndicator &&
         md->Entries[i].additionalParameterIndicator) {
-        D_ADDITIONAL_MODEL_PARAMETER_DATA(md->Entries[i].additionalParameterData, additionalBits)
+        /* DF+071 allows up to 255 bits, only 32 can be stored: skip the
+           leading excess bits, keep the trailing 32 */
+        while (additionalBits > 32) {
+          unsigned int n = (additionalBits - 32 > 32) ? 32 : additionalBits - 32;
+          SKIPSSRBITS(n)
+          additionalBits -= n;
+        }
+        if (additionalBits)
+          D_ADDITIONAL_MODEL_PARAMETER_DATA(md->Entries[i].additionalParameterData, additionalBits)
 #ifdef BNC_DEBUG_SSR 
         fprintf(stderr, "- additional-data-parameter-data     : %d\n", md->Entries[i].additionalParameterData);

trunk/BNC/src/RTCM3/crs.h

@@ -24 +24 @@
   }
   void clear(void) {
-    memset(_name, '\0', 31 * sizeof(char));
+    memset(_name, '\0', sizeof(_name));
     _coordinateEpoch = 0;
     _CE              = 0;
@@ -38 +38 @@
     void setCoordinateEpochFromCE() {(!_CE) ? _coordinateEpoch = 0.0 : _coordinateEpoch = 1900 + _CE; }
     void setCEFromCoordinateEpoch() {(!_coordinateEpoch) ? _CE = 0 : _CE = _coordinateEpoch -1900; }
-    char     _name[31];
+    char     _name[32]; // up to 31 characters (5-bit length) + terminating 0
     double   _coordinateEpoch;
     double   _CE;
@@ -55 +55 @@
     }
     void clear() {
-      memset(_name, '\0', 31 * sizeof(char));
+      memset(_name, '\0', sizeof(_name));
       _anchor = 0;
       _plateNumber = 0;
@@ -71 +71 @@
       }
     }
-    char             _name[31];
+    char             _name[32]; // up to 31 characters (5-bit length) + terminating 0
     int              _anchor;           // 0.. global CRS (=> Plate number 0), 1.. plate-fixed CRS
     int              _plateNumber;      // 0.. unknown, 7.. Eurasia
@@ -171 +171 @@
        cout << endl;
      }
-     char           _sourceName[31];
-     char           _targetName[31];
+     char           _sourceName[32]; // up to 31 characters (5-bit length) + terminating 0
+     char           _targetName[32];
      int            _sysIdentNum;
      int            _utilTrafoMessageIndicator;

trunk/BNC/src/bncnetqueryrtp.cpp

@@ -47 +47 @@
   _status = finished;
   if (_socket) {
-    QByteArray reqStr = "TEARDOWN " + _url.toEncoded() + " RTSP/1.0\r\n"
+    QByteArray reqStr = "TEARDOWN " + _url.toEncoded(QUrl::RemoveUserInfo) + " RTSP/1.0\r\n"
                       + "CSeq: " + QString("%1").arg(++_CSeq).toLatin1() + "\r\n"
                       + "Session: " + _session + "\r\n"
@@ -59 +59 @@
 void bncNetQueryRtp::slotKeepAlive() {
   if (_socket) {
-    QByteArray reqStr = "GET_PARAMETER " + _url.toEncoded() + " RTSP/1.0\r\n"
+    QByteArray reqStr = "GET_PARAMETER " + _url.toEncoded(QUrl::RemoveUserInfo) + " RTSP/1.0\r\n"
                       + "CSeq: " + QString("%1").arg(++_CSeq).toLatin1() + "\r\n"
                       + "Session: " + _session + "\r\n"
@@ -144 +144 @@
 
     QByteArray reqStr;
-    reqStr = "SETUP " + _url.toEncoded() + " RTSP/1.0\r\n"
+    reqStr = "SETUP " + _url.toEncoded(QUrl::RemoveUserInfo) + " RTSP/1.0\r\n"
            + "CSeq: " + QString("%1").arg(++_CSeq).toLatin1() + "\r\n"
            + "Ntrip-Version: Ntrip/2.0\r\n"
@@ -202 +202 @@
           }
 
-          reqStr = "PLAY " + _url.toEncoded() + " RTSP/1.0\r\n"
+          reqStr = "PLAY " + _url.toEncoded(QUrl::RemoveUserInfo) + " RTSP/1.0\r\n"
                  + "CSeq: " + QString("%1").arg(++_CSeq).toLatin1() + "\r\n"
                  + "Session: " + _session + "\r\n"
@@ -216 +216 @@
               while (!line.isEmpty()) {
                 if (line.indexOf("200 OK") != -1) {
-                  emit newMessage(_url.toEncoded().replace(0,1,"")
+                  emit newMessage(_url.toEncoded(QUrl::RemoveUserInfo).replace(0,1,"")
                             + ": UDP connection established", true);
                   slotKeepAlive();
@@ -233 +233 @@
   _socket = 0;
   _status = error;
-  emit newMessage(_url.toEncoded().replace(0,1,"")
+  emit newMessage(_url.toEncoded(QUrl::RemoveUserInfo).replace(0,1,"")
                   + ": NetQuery, waiting for connect", true);
 }

trunk/BNC/src/bncnetqueryv1.cpp

@@ -225 +225 @@
              + userAndPwd + "\r\n";
   } else {
-    reqStr = "GET " + _url.toEncoded() + " HTTP/1.0\r\n"
+    reqStr = "GET " + _url.toEncoded(QUrl::RemoveUserInfo) + " HTTP/1.0\r\n"
              + "User-Agent: NTRIP BNC/" BNCVERSION " (" BNC_OS ")\r\n"
              + "Host: " + _url.host().toLatin1() + "\r\n"

trunk/BNC/src/upload/bncrtnetuploadcaster.cpp

@@ -504 +504 @@
             in >> ui >> vtec.NumLayers;
             vtec.UpdateInterval = (unsigned int)determineUpdateInd(ui);
+            if (vtec.NumLayers > VTEC_NUMIONOLAYERS) {
+                vtec.NumLayers = 0;
+            }
             for (unsigned ll = 0; ll < vtec.NumLayers; ll++) {
                 int dummy;
                 in >> dummy >> vtec.Layers[ll].Degree >> vtec.Layers[ll].Order
                     >> vtec.Layers[ll].Height;
+                if (vtec.Layers[ll].Degree < 1 || vtec.Layers[ll].Degree > VTEC_MAXIONODEGREE ||
+                    vtec.Layers[ll].Order  < 1 || vtec.Layers[ll].Order  > VTEC_MAXIONOORDER) {
+                    vtec.NumLayers = 0;
+                    break;
+                }
                 for (unsigned iDeg = 0; iDeg <= vtec.Layers[ll].Degree; iDeg++) {
                     for (unsigned iOrd = 0; iOrd <= vtec.Layers[ll].Order; iOrd++) {