Changeset 11124 in ntrip for trunk/BNC/tests/README.md

Timestamp:

Oct 24, 2026, 10:10:29 PM (4 days ago)

Author:

stuerze

Message:

Some fixes regarding memory corruption from stream data, credential exposure,

File:

• trunk/BNC/tests/README.md (modified) (2 diffs)

trunk/BNC/tests/README.md

@@ -28 +28 @@
 | `tools/fakecaster.py` | local Ntrip caster recording an upload as a BNC raw file (case key `fakecaster`) |
 | `tools/bncraw.py` | `info` (streams, time span, RTCM3 message types) and `slice` for raw captures |
+| `tools/mkcrafted.py` | writes `data/crafted_limits.raw`: crafted frames at the upper field limits |
+| `tools/ssr_harness.sh` | builds `tools/ssr_harness.cpp` with the SSR decoders under ASan/UBSan and runs it |
 | `work/` | scratch output, not versioned |
 
@@ -90 +92 @@
   'QC Bias File' (code bias check against the other ACs and the file).
 
+* `decoder_limits`: crafted, CRC-valid frames from `tools/mkcrafted.py`
+  using the largest values the formats allow: VTEC with degree/order 16
+  (IGS-SSR 4076/201 and RTCM-SSR 1264, 2 and 4 layers) and RTCM 1300/1301/1302
+  with 31-character names, listed by the RTCM scan in the log. The
+  coefficients are C(d,o) = (100*d+o)/200 TECU and S = -C, both `.ssr` files
+  are identical apart from the station ID. These frames overflowed the
+  coefficient and name arrays; the 4-layer VTEC crashed BNC.
+
+## Sanitizer check of the SSR decoders
+
+```
+tests/tools/ssr_harness.sh            # crafted_limits.raw
+tests/tools/ssr_harness.sh tests/data/*.raw   # real captures
+```
+
+In BNC all SSR target structs are members of one `RTCM3coDecoder` object,
+so a write beyond one struct corrupts the next member without any
+AddressSanitizer report. The harness decodes every frame with all three
+format classes into separately allocated structs, so ASan reports it. It
+also covers the new RTCM-SSR metadata (message 60 in
+`crafted_limits.raw`: 7 entries with additional parameters of 40 and 0 bits,
+and 31 entries, which must be rejected), which `RTCM3Decoder.cpp` does not
+dispatch at present. Exit code 0 only without sanitizer errors.
+
 ## Adding a replay case