Changeset 11126 in ntrip for trunk/BNC/src/RTCM3

Timestamp:

Oct 24, 2026, 11:14:36 PM (3 weeks ago)

Author:

stuerze

Message:

Some fixes from security point of view

Location:

trunk/BNC/src/RTCM3

Files:

• clock_and_orbit/clock_orbit_rtcm_new.cpp (modified) (2 diffs)
• crsEncoder.cpp (modified) (5 diffs)

trunk/BNC/src/RTCM3/clock_and_orbit/clock_orbit_rtcm_new.cpp

@@ -472 +472 @@
       for (i = 0; i < md->NumEntries; i++) {
         E_MODEL_CORRECTION_TYPE_INDICATOR(md->Entries[i].TypeIndicator)
-        E_ADDITIONAL_MODEL_PARAMETER_INDICATOR(md->Entries[i].ApplicationIndicator)
+        E_MODEL_CORRECTION_APPLICATION_INDICATOR(md->Entries[i].ApplicationIndicator)
         E_NON_DEFAULT_MODEL_CORRECTION_INDICATOR(md->Entries[i].nonDefaultIndicator)
         if (md->Entries[i].nonDefaultIndicator) {
@@ -489 +489 @@
         if (md->Entries[i].nonDefaultIndicator &&
             md->Entries[i].additionalParameterIndicator) {
-          E_ADDITIONAL_MODEL_PARAMETER_DATA(md->Entries[i].additionalParameterData, md->Entries[i].additionalParameterNumBits)       
+          /* up to 255 bits, only 32 stored (leading bits zero); in pieces of
+             16 bits, as ADDBITS cannot handle more than 30 bits */
+          unsigned int k = md->Entries[i].additionalParameterNumBits;
+          while (k) {
+            unsigned int n = (k > 16) ? 16 : k;
+            k -= n;
+            E_ADDITIONAL_MODEL_PARAMETER_DATA((k < 32) ? (md->Entries[i].additionalParameterData >> k) : 0, n)
+          }
       }
     }

trunk/BNC/src/RTCM3/crsEncoder.cpp

@@ -11 +11 @@
 using namespace std;
 
+// Length of a name for the 5-bit length field: up to the terminating 0,
+// at most 31 characters
+////////////////////////////////////////////////////////////////////////////
+static int nameLength(const char* name, size_t bufSize) {
+  size_t n = strnlen(name, bufSize);
+  return (n > 31) ? 31 : int(n);
+}
+
 // build up RTCM3 for serviceCrs
 ////////////////////////////////////////////////////////////////////////////
@@ -17 +25 @@
   INITBLOCK
   ADDBITS(12, 1300)
-  int N = sizeof(serviceCrs._name) / sizeof(serviceCrs._name[0]);
-  if (N > 31) {N = 31;}
+  int N = nameLength(serviceCrs._name, sizeof(serviceCrs._name));
   ADDBITS(5, N)
   for(int i = 0; i < N; i++) {
@@ -35 +42 @@
 
   ADDBITS(12, 1302)
-  int N = sizeof(rtcmCrs._name) / sizeof(rtcmCrs._name[0]);
-  if (N > 31) {N = 31;}
+  int N = nameLength(rtcmCrs._name, sizeof(rtcmCrs._name));
   ADDBITS(5, N)
   for(int i = 0; i < N; i++) {
@@ -44 +50 @@
   ADDBITS(5, rtcmCrs._plateNumber)
   int dblinknum = rtcmCrs._databaseLinks.size();
+  if (dblinknum > 7) {dblinknum = 7;} // 3 bits
   ADDBITS(3, dblinknum);
-  if (dblinknum) {
-    for(int d = 0; d < dblinknum; d++) {
-      N = sizeof(rtcmCrs._databaseLinks[d]) / sizeof(rtcmCrs._databaseLinks[d][0]);
-      for(int i = 0; i < N; i++) {
-        ADDBITS(8, rtcmCrs._databaseLinks[d].toLatin1()[i])
-      }
+  for(int d = 0; d < dblinknum; d++) {
+    QByteArray dblink = rtcmCrs._databaseLinks[d].toLatin1();
+    N = nameLength(dblink.constData(), dblink.size());
+    ADDBITS(5, N)
+    for(int i = 0; i < N; i++) {
+      ADDBITS(8, dblink[i])
     }
   }
@@ -65 +72 @@
 
   ADDBITS(12, 1301)
-  int N = sizeof(helmertPar._sourceName) / sizeof(helmertPar._sourceName[0]);
-  if (N > 31) {N = 31;}
+  int N = nameLength(helmertPar._sourceName, sizeof(helmertPar._sourceName));
   ADDBITS(5, N)
   for(int i = 0; i < N; i++) {
     ADDBITS(8, helmertPar._sourceName[i])
   }
-  N = sizeof(helmertPar._targetName) / sizeof(helmertPar._targetName[0]);
-  if (N > 31) {N = 31;}
+  N = nameLength(helmertPar._targetName, sizeof(helmertPar._targetName));
   ADDBITS(5, N)
   for(int i = 0; i < N; i++) {