djsundog
/
circuitpython
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Validate portions of mpy load to detect corruption 

Fixes #1917
This commit is contained in:
Scott Shawcroft 2019-06-25 15:39:07 -07:00
parent ecf24420d5
commit 330517bde9
No known key found for this signature in database
GPG Key ID: 9349BC7E64B1921E
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
py/persistentcode.c
View File

@ -128,6 +128,12 @@ STATIC qstr load_qstr(mp_reader_t *reader) {
size_t len = read_uint(reader); size_t len = read_uint(reader);
char str[len]; char str[len];
read_bytes(reader, (byte*)str, len); read_bytes(reader, (byte*)str, len);
// Validate the QSTRs by ensuring they do not contain any null terminations. They are length encoded instead.
for (size_t i = 0; i < len; i++) {
if (str[i] == '\0') {
mp_raise_RuntimeError(translate("Corrupt .mpy file"));
}
}
qstr qst = qstr_from_strn(str, len); qstr qst = qstr_from_strn(str, len);
return qst; return qst;
} }
@ -145,11 +151,12 @@ STATIC mp_obj_t load_obj(mp_reader_t *reader) {
return mp_obj_new_str_from_vstr(obj_type == 's' ? &mp_type_str : &mp_type_bytes, &vstr); return mp_obj_new_str_from_vstr(obj_type == 's' ? &mp_type_str : &mp_type_bytes, &vstr);
} else if (obj_type == 'i') { } else if (obj_type == 'i') {
return mp_parse_num_integer(vstr.buf, vstr.len, 10, NULL); return mp_parse_num_integer(vstr.buf, vstr.len, 10, NULL);
} else { } else if (obj_type == 'f' || obj_type == 'c') {
assert(obj_type == 'f' || obj_type == 'c');
return mp_parse_num_decimal(vstr.buf, vstr.len, obj_type == 'c', false, NULL); return mp_parse_num_decimal(vstr.buf, vstr.len, obj_type == 'c', false, NULL);
} }
} }
mp_raise_RuntimeError(translate("Corrupt .mpy file"));
return MP_OBJ_FROM_PTR(&mp_const_none_obj);
} }
STATIC void load_bytecode_qstrs(mp_reader_t *reader, byte *ip, byte *ip_top) { STATIC void load_bytecode_qstrs(mp_reader_t *reader, byte *ip, byte *ip_top) {