Skip to content

Buffer Overflow / Crash #5

@jmscreation

Description

@jmscreation

#define SMCBUFSIZE 1000
uint8_t buffer[SMCBUFSIZE];
The buffer allocates 1000 bytes by default, but there is no indication of this anywhere.

memcpy(&buffer[len], payload, payloadlen); This causes a memory buffer overflow to corrupt memory.

The maximum payload size is 1000, but should instead be dynamic. There should be cache buffer to continue pushing the data beyond a large payload size, instead of just writing into unknown memory. This is a major bug.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions