Changeset 11124 in ntrip for trunk/BNC/src/RTCM3

Timestamp:

Oct 24, 2026, 10:10:29 PM (5 days ago)

Author:

stuerze

Message:

Some fixes regarding memory corruption from stream data, credential exposure,

Location:

trunk/BNC/src/RTCM3

Files:

• RTCM3Decoder.cpp (modified) (1 diff)
• clock_and_orbit/clock_orbit.h (modified) (1 diff)
• clock_and_orbit/clock_orbit_rtcm_new.cpp (modified) (2 diffs)
• crs.h (modified) (5 diffs)

trunk/BNC/src/RTCM3/RTCM3Decoder.cpp

@@ -2173 +2173 @@
     for (int i = 0; i < dblinksnum; i++) {
       int dblinknum = -1;
-      char dblinkname[31];
+      char dblinkname[32]; // up to 31 characters (5-bit length) + terminating 0
       GETBITS(dblinknum, 5)
       if (dblinknum > -1 && dblinknum <= 31) {

trunk/BNC/src/RTCM3/clock_and_orbit/clock_orbit.h

@@ -454 +454 @@
       unsigned int Degree; /* 1-16 */
       unsigned int Order;  /* 1-16 */
-      double Sinus[VTEC_MAXIONODEGREE][VTEC_MAXIONOORDER];
-      double Cosinus[VTEC_MAXIONODEGREE][VTEC_MAXIONOORDER];
+      /* indices 0 .. Degree / 0 .. Order, both up to 16 */
+      double Sinus[VTEC_MAXIONODEGREE+1][VTEC_MAXIONOORDER+1];
+      double Cosinus[VTEC_MAXIONODEGREE+1][VTEC_MAXIONOORDER+1];
     } Layers[VTEC_NUMIONOLAYERS];
   };

trunk/BNC/src/RTCM3/clock_and_orbit/clock_orbit_rtcm_new.cpp

@@ -637 +637 @@
       fprintf(stderr, "ssrIod %d providerId %d solId %d numEntries %d \n",
       md->SSRIOD, md->SSRProviderID, md->SSRSolutionID, md->NumEntries);
-#endif 
+#endif
+    if (md->NumEntries > META_MAXNUMENTRIES) { /* DF+063 is 5 bits wide */
+      md->NumEntries = 0;
+      return GCOBR_DATAMISMATCH;
+    }
     for (i = 0; i < md->NumEntries; i++) {
       unsigned int additionalBits;
@@ -687 +691 @@
       if (md->Entries[i].nonDefaultIndicator &&
         md->Entries[i].additionalParameterIndicator) {
-        D_ADDITIONAL_MODEL_PARAMETER_DATA(md->Entries[i].additionalParameterData, additionalBits)
+        /* DF+071 allows up to 255 bits, only 32 can be stored: skip the
+           leading excess bits, keep the trailing 32 */
+        while (additionalBits > 32) {
+          unsigned int n = (additionalBits - 32 > 32) ? 32 : additionalBits - 32;
+          SKIPSSRBITS(n)
+          additionalBits -= n;
+        }
+        if (additionalBits)
+          D_ADDITIONAL_MODEL_PARAMETER_DATA(md->Entries[i].additionalParameterData, additionalBits)
 #ifdef BNC_DEBUG_SSR 
         fprintf(stderr, "- additional-data-parameter-data     : %d\n", md->Entries[i].additionalParameterData);

trunk/BNC/src/RTCM3/crs.h

@@ -24 +24 @@
   }
   void clear(void) {
-    memset(_name, '\0', 31 * sizeof(char));
+    memset(_name, '\0', sizeof(_name));
     _coordinateEpoch = 0;
     _CE              = 0;
@@ -38 +38 @@
     void setCoordinateEpochFromCE() {(!_CE) ? _coordinateEpoch = 0.0 : _coordinateEpoch = 1900 + _CE; }
     void setCEFromCoordinateEpoch() {(!_coordinateEpoch) ? _CE = 0 : _CE = _coordinateEpoch -1900; }
-    char     _name[31];
+    char     _name[32]; // up to 31 characters (5-bit length) + terminating 0
     double   _coordinateEpoch;
     double   _CE;
@@ -55 +55 @@
     }
     void clear() {
-      memset(_name, '\0', 31 * sizeof(char));
+      memset(_name, '\0', sizeof(_name));
       _anchor = 0;
       _plateNumber = 0;
@@ -71 +71 @@
       }
     }
-    char             _name[31];
+    char             _name[32]; // up to 31 characters (5-bit length) + terminating 0
     int              _anchor;           // 0.. global CRS (=> Plate number 0), 1.. plate-fixed CRS
     int              _plateNumber;      // 0.. unknown, 7.. Eurasia
@@ -171 +171 @@
        cout << endl;
      }
-     char           _sourceName[31];
-     char           _targetName[31];
+     char           _sourceName[32]; // up to 31 characters (5-bit length) + terminating 0
+     char           _targetName[32];
      int            _sysIdentNum;
      int            _utilTrafoMessageIndicator;