Changeset 11130 in ntrip for trunk/BNC/src

Timestamp:

Oct 28, 2026, 9:32:30 AM (10 days ago)

Author:

stuerze

Message:

Some fixes from security point of view

Location:

trunk/BNC/src

Files:

• RTCM/RTCM2.cpp (modified) (2 diffs)
• RTCM3/RTCM3Decoder.cpp (modified) (4 diffs)
• RTCM3/bits.h (modified) (2 diffs)
• RTCM3/clock_and_orbit/clock_orbit.h (modified) (1 diff)
• RTCM3/clock_and_orbit/clock_orbit_rtcm_new.cpp (modified) (1 diff)
• bnchelp.html (modified) (4 diffs)
• bncmain.cpp (modified) (1 diff)
• bncnetqueryrtp.cpp (modified) (3 diffs)
• bncnetqueryv1.cpp (modified) (2 diffs)
• src.pri (modified) (1 diff)

trunk/BNC/src/RTCM/RTCM2.cpp

@@ -667 +667 @@
   };
 
-  if ( 24*DW.size() < start+n-1 ) {
+  if ( 24*DW.size() < start+n ) { // last bit read: start+n-1
 #if (DEBUG>0)
     cerr << "Debug output RTCM2packet::getUnsignedBits" << endl
@@ -727 +727 @@
   };
 
-  if ( 24*DW.size() < start+n-1 ) {
+  if ( 24*DW.size() < start+n ) { // last bit read: start+n-1
 #if (DEBUG>0)
     cerr << "Debug output RTCM2packet::getUnsignedBits" << endl

trunk/BNC/src/RTCM3/RTCM3Decoder.cpp

@@ -39 +39 @@
  * -----------------------------------------------------------------------*/
 
+#include <atomic>
 #include <iostream>
 #include <iomanip>
@@ -241 +242 @@
 /**
  * Frequency numbers of GLONASS with an offset of 100 to detect unset values.
- * Gets filled by ephemeris and data blocks and shared between different streams.
+ * Gets filled by ephemeris and data blocks and shared between different streams
+ * (MSM4/6 streams without channel numbers use those of an ephemeris stream).
+ * Atomic, as the streams are decoded in different threads.
  */
-static int GLOFreq[RTCM3_MSM_NUMSAT];
+static std::atomic<int> GLOFreq[RTCM3_MSM_NUMSAT];
 
 /*
@@ -1998 +2001 @@
   GETSTRING(antnum, antenna)
   if ((antnum > -1 && antnum < 265) &&
-      (_antType.empty() || strncmp(_antType.back()._descriptor, antenna, recnum) != 0)) {
+      (_antType.empty() || int(strlen(_antType.back()._descriptor)) != antnum ||
+       strncmp(_antType.back()._descriptor, antenna, antnum) != 0)) {
     _antType.push_back(t_antInfo());
     memcpy(_antType.back()._descriptor, antenna, antnum);
@@ -2017 +2021 @@
     GETSTRING(recsernum, recserialnum)
     if ((recnum > -1 && recnum < 265) &&
-        (_recType.empty() || strncmp(_recType.back()._descriptor, receiver, recnum) != 0)) {
+        (_recType.empty() || int(strlen(_recType.back()._descriptor)) != recnum ||
+         strncmp(_recType.back()._descriptor, receiver, recnum) != 0)) {
       _recType.push_back(t_recInfo());
       memcpy(_recType.back()._descriptor, receiver, recnum);

trunk/BNC/src/RTCM3/bits.h

@@ -104 +104 @@
    b = variable to store size, s = variable to store string pointer */
 #define GETSTRING(b, s) { \
+  if(size < 1) return false; \
   b = *(data++); \
+  --size; \
+  if((b) > size) return false; \
   s = (char *) data; \
   data += b; \
-  size -= b+1; \
+  size -= b; \
 }
 
@@ -126 +129 @@
   }
 
+/* up to 56 bits: less than 8 bits are pending in the 64-bit bitbuffer */
 #define ADDBITS(a, b) { \
-    bitbuffer = (bitbuffer<<(a))|((b)&((1<<a)-1)); \
+    bitbuffer = (bitbuffer<<(a))|((uint64_t)(b)&((1ULL<<(a))-1)); \
     numbits += (a); \
     STOREBITS \

trunk/BNC/src/RTCM3/clock_and_orbit/clock_orbit.h

@@ -605 +605 @@
 #define E_NADIR_ANGLE_DEPENDENT_CORR_RANGE_EXTENSION(a) ADDBITS(4,  a)                      /* DF+015 (new RTCM) to extend DF+021*/
 #define E_SATELLITE_SET_INDICATOR(a)                    ADDBITS(1,  a)                      /* DF+016 (new RTCM) */
-/* ADDBITS' mask "(1<<a)-1" uses a 32-bit int literal, so a plain
-   ADDBITS(64, a) is broken the same way GETSSRBITS(a, 64) was on decode
-   (see D_SATELLITE_MASK) - here even ADDBITS(32, ...) is unsafe, since
-   shifting a 32-bit int by exactly its own width is undefined behavior
-   too. Stay well clear of that edge by writing four 16-bit chunks. */
+/* ADDBITS handles up to 56 bits, so the 64-bit mask is written as two
+   32-bit halves (as GETSSRBITS(a, 64) does not work either, see
+   D_SATELLITE_MASK). */
 #define E_SATELLITE_MASK(a)                             { \
   uint64_t mask64_ = (a); \
-  ADDBITS(16, (mask64_ >> 48) & 0xFFFFU) \
-  ADDBITS(16, (mask64_ >> 32) & 0xFFFFU) \
-  ADDBITS(16, (mask64_ >> 16) & 0xFFFFU) \
-  ADDBITS(16,  mask64_        & 0xFFFFU) \
+  ADDBITS(32, mask64_ >> 32) \
+  ADDBITS(32, mask64_ & 0xFFFFFFFFU) \
 }                                                                                           /* DF394 */
 #define E_FREQUENCY_SET_INDICATOR(a)                    ADDBITS(1,  a)                      /* DF+017 (new RTCM) */

trunk/BNC/src/RTCM3/clock_and_orbit/clock_orbit_rtcm_new.cpp

@@ -489 +489 @@
         if (md->Entries[i].nonDefaultIndicator &&
             md->Entries[i].additionalParameterIndicator) {
-          /* up to 255 bits, only 32 stored (leading bits zero); in pieces of
-             16 bits, as ADDBITS cannot handle more than 30 bits */
+          /* up to 255 bits, only 32 stored: leading zero bits (ADDBITS
+             handles at most 56 bits at a time), then the value */
           unsigned int k = md->Entries[i].additionalParameterNumBits;
-          while (k) {
-            unsigned int n = (k > 16) ? 16 : k;
+          while (k > 32) {
+            unsigned int n = (k - 32 > 56) ? 56 : k - 32;
+            ADDBITS(n, 0)
             k -= n;
-            E_ADDITIONAL_MODEL_PARAMETER_DATA((k < 32) ? (md->Entries[i].additionalParameterData >> k) : 0, n)
-          }
+          }
+          if (k)
+            E_ADDITIONAL_MODEL_PARAMETER_DATA(md->Entries[i].additionalParameterData, k)
       }
     }

trunk/BNC/src/bnchelp.html

@@ -147 +147 @@
     &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2.8.2 <a href="#corrint">Interval</a><br>
     &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2.8.3 <a href="#corrport">Port</a><br>
-    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2.8.4 <a href="#ssrqc">QC Directory, QC Streams, QC Reference, QC Interval, QC Bias File</a><br>
+    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2.8.4 <a href="#ssrqc">QC Directory, QC Streams, QC Reference, QC Interval, QC Bias File, QC ANTEX File</a><br>
     &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2.8.4 <a href="#corrwait">Wait for Full Corr Epoch</a><br>
     &nbsp; &nbsp; &nbsp; 2.9 <a href="#syncout"><b>Feed Engine</b></a><br>
@@ -5097 +5097 @@
 
   <p>
-  <h4 id="ssrqc">2.8.4 QC Directory, QC Streams, QC Reference, QC Interval, QC Bias File - optional</h4>
+  <h4 id="ssrqc">2.8.4 QC Directory, QC Streams, QC Reference, QC Interval, QC Bias File, QC ANTEX File - optional</h4>
   </p>
   <p>
@@ -5106 +5106 @@
     e.g. 'ALL,!SIRGAS200001' for a stream referring to another reference frame than the ITRF. 'QC Reference' selects the reference of the stream comparison (see below). Select
     the 'QC Interval' for the reports (default: 1 hour). A 'QC Bias File' (Bias SINEX, OSB or DSB, e.g. a CAS DCB or
-    a GFZ OSB product) is an optional reference for the code bias check (see below). One daily file
+    a GFZ OSB product) is an optional reference for the code bias check (see below). A 'QC ANTEX File' (e.g. the
+    current igs20.atx) enables the attitude check (see below). One daily file
     '&lt;stream&gt;_S_&lt;YYYYDDD&gt;0000_01D_QC.txt' is written per stream; at the end of each interval and at the
     end of the program, a report per system is appended. Broadcast ephemerides must be received as well, e.g. via
@@ -5241 +5242 @@
     clock 0.689 (STD 0.008), radial 0.020, along 0.036, cross 0.022, SIS (radial - clock) 0.687 (STD 0.008)
   G satellites deviating from the reference, RMS SIS [m]: G02(0.38) G16(0.33) G20(0.91) G26(3.36)
+</pre>
+  <p>
+    <b>Attitude check:</b> With a 'QC ANTEX File', BNC checks for every stream sending the satellite yaw angle whether
+    its clocks are consistent with its yaw angles during noon and midnight turns. In every stream comparison (30
+    seconds), the difference of the yaw angle of BNC's attitude model ('Computed', see section 'Combination') minus the
+    yaw angle of the stream is followed continuously over time; the phase wind-up predicts a clock difference of the
+    stream to an AC following the model of lambda_IF * dpsi / 2pi (lambda_IF: ionosphere-free wavelength of the
+    reference signals, about 10.7 cm for GPS). A turn starts when the yaw difference changes by more than 20 degrees
+    against the samples 5 to 15 minutes before, and ends when it is stable again within 2 degrees for 10 minutes. For
+    each turn, the observed clock change of the stream relative to the consensus is compared with the predicted one:
+    the changes at the end of the turn, the regression slope of the observed on the predicted changes, and the clock
+    RMS during the turn without and with the predicted change. A slope between 0.7 and 1.3 with the RMS reduced by
+    at least half means that the yaw angles in the stream describe the attitude the AC used for its clocks - the
+    condition for selecting the attitude 'SSR' for this AC in the combination. Turns with a predicted change below 3
+    cm are not assessed; a clock change of at least 3 cm is then reported as not explained by the yaw difference,
+    which shows that the other ACs model this turn differently from BNC's model (the check assumes that the consensus
+    follows it), e.g.
+  </p>
+  <pre>
+  G attitude check G14 09:42:30-10:25:30: yaw difference to the model 362 deg, clock change vs. consensus 8.2 cm, predicted 10.7 cm (max 10.7 cm), slope 0.77, clock RMS 6.1 -> 2.0 cm: SSR yaw consistent with the clocks
+  G attitude check G25 07:53:00-08:51:30: yaw difference to the model 39 deg, clock change vs. consensus -9.8 cm, predicted -0.0 cm (max 1.2 cm), slope 1.84, clock RMS 5.9 -> 5.8 cm: clock change not explained by the yaw difference (the other ACs model this turn differently?)
 </pre>
   <p>

trunk/BNC/src/bncmain.cpp

@@ -215 +215 @@
         "   ssrQcIntr    {SSR QC report interval [character string: 5 min|15 min|30 min|1 hour|1 day]}\n"
         "   ssrQcBiasFile {Bias SINEX file (OSB or DSB) as reference for the SSR QC code bias check, full path [character string]}\n"
+        "   ssrQcAntexFile {ANTEX file for the SSR QC attitude check (SSR yaw vs. clocks during turns), full path [character string]}\n"
         "\n"
         "Feed Engine Panel keys:\n"

trunk/BNC/src/bncnetqueryrtp.cpp

@@ -110 +110 @@
 
   const int timeOut = 5000;
+  const int maxHeaderLines = 100; // of an RTSP answer
 
   _status = running;
@@ -177 +178 @@
         QByteArray serverPort;
         QString line = in.readLine();
-        while (!line.isEmpty()) {
+        int nLines = 0;
+        while (!line.isEmpty() && ++nLines <= maxHeaderLines) {
           if (line.indexOf("Session:") == 0) {
             _session = line.mid(9).toLatin1();
@@ -226 +228 @@
               QTextStream in(_socket);
               line = in.readLine();
-              while (!line.isEmpty()) {
+              nLines = 0;
+              while (!line.isEmpty() && ++nLines <= maxHeaderLines) {
                 if (line.indexOf("200 OK") != -1) {
                   emit newMessage(_url.toEncoded(QUrl::RemoveUserInfo).replace(0,1,"")

trunk/BNC/src/bncnetqueryv1.cpp

@@ -253 +253 @@
     bool proxyResponse = false;
     QStringList response;
+    const int maxResponseSize = 16384;
+    int responseSize = 0;
     while (true) {
       if (_socket->canReadLine()) {
         QString line = _socket->readLine();
+
+        // a caster response header is short; do not collect an endless one
+        responseSize += line.size();
+        if (responseSize > maxResponseSize) {
+          delete _socket;
+          _socket = 0;
+          _status = error;
+          emit newMessage(_url.path().toLatin1().replace(0,1,"")
+                          + ": Caster response header too long", true);
+          return;
+        }
     
         if (line.indexOf("ICY 200 OK") == -1 && 
@@ -289 +302 @@
         break;
         }
+      }
+      else if (_socket->bytesAvailable() > maxResponseSize) { // no line end
+        delete _socket;
+        _socket = 0;
+        _status = error;
+        emit newMessage(_url.path().toLatin1().replace(0,1,"")
+                        + ": Caster response header too long", true);
+        return;
       }
       else if (!_socket->waitForReadyRead(_timeOut)) {

trunk/BNC/src/src.pri

@@ -19 +19 @@
 
 win32:QMAKE_CXXFLAGS += /std:c++17
+
+# Hardening, independent of the distribution's compiler defaults: stack
+# protector, bounds checks of the std containers (abort instead of memory
+# corruption), read-only relocations. _FORTIFY_SOURCE is not set, it requires
+# optimization, which is switched off above.
+linux:QMAKE_CXXFLAGS += -fstack-protector-strong -D_GLIBCXX_ASSERTIONS
+linux:QMAKE_LFLAGS   += -Wl,-z,relro,-z,now
 
 debug:OBJECTS_DIR=.obj/debug