Changeset 11128 in ntrip for trunk/BNC/src/bncrawfile.cpp

Timestamp:

Oct 24, 2026, 11:37:52 PM (13 days ago)

Author:

stuerze

Message:

Some fixes from security point of view

File:

• trunk/BNC/src/bncrawfile.cpp (modified) (1 diff)

trunk/BNC/src/bncrawfile.cpp

@@ -138 +138 @@
       BNC_CORE->setDateAndTimeGPS(QDateTime(QDateTime::fromString(lst.value(0), Qt::ISODate)));
       
+      // the station ID becomes part of output file names: no path separators
       _staID  = lst.value(1).toLatin1();
+      for (int ii = 0; ii < _staID.size(); ii++) {
+        if (_staID[ii] == '/' || _staID[ii] == '\\' || (unsigned char)_staID[ii] < 0x20) {
+          _staID[ii] = '_';
+        }
+      }
       _format = lst.value(2).toLatin1();
-      int nBytes = lst.value(3).toInt();
-      
+      bool ok;
+      int nBytes = lst.value(3).trimmed().toInt(&ok);
+      if (!ok || nBytes < 0 || nBytes > (1 << 24)) {
+        BNC_CORE->slotMessage("Raw file: invalid chunk header: " + line.trimmed().left(80).toLatin1(), true);
+        return data;
+      }
+
       data = _inpFile->read(nBytes);