|
24 | 24 | #include <app/InteractionModelEngine.h>
|
25 | 25 | #include <app/reporting/reporting.h>
|
26 | 26 | #include <app/util/config.h>
|
| 27 | +#include <app/util/ember-io-storage.h> |
27 | 28 | #include <app/util/ember-strings.h>
|
28 | 29 | #include <app/util/endpoint-config-api.h>
|
29 | 30 | #include <app/util/generic-callbacks.h>
|
@@ -292,6 +293,30 @@ CHIP_ERROR emberAfSetDynamicEndpoint(uint16_t index, EndpointId id, const EmberA
|
292 | 293 | }
|
293 | 294 | }
|
294 | 295 |
|
| 296 | + const size_t bufferSize = Compatibility::Internal::gEmberAttributeIOBufferSpan.size(); |
| 297 | + for (uint8_t i = 0; i < ep->clusterCount; i++) |
| 298 | + { |
| 299 | + const EmberAfCluster * cluster = &(ep->cluster[i]); |
| 300 | + if (!cluster->attributes) |
| 301 | + { |
| 302 | + continue; |
| 303 | + } |
| 304 | + |
| 305 | + for (uint16_t j = 0; j < cluster->attributeCount; j++) |
| 306 | + { |
| 307 | + const EmberAfAttributeMetadata * attr = &(cluster->attributes[j]); |
| 308 | + uint16_t attrSize = emberAfAttributeSize(attr); |
| 309 | + if (attrSize > bufferSize) |
| 310 | + { |
| 311 | + ChipLogError(DataManagement, |
| 312 | + "Attribute size %u exceeds max size %lu, (attrId=" ChipLogFormatMEI ", clusterId=" ChipLogFormatMEI |
| 313 | + ")", |
| 314 | + attrSize, static_cast<unsigned long>(bufferSize), ChipLogValueMEI(attr->attributeId), |
| 315 | + ChipLogValueMEI(cluster->clusterId)); |
| 316 | + return CHIP_ERROR_NO_MEMORY; |
| 317 | + } |
| 318 | + } |
| 319 | + } |
295 | 320 | emAfEndpoints[index].endpoint = id;
|
296 | 321 | emAfEndpoints[index].deviceTypeList = deviceTypeList;
|
297 | 322 | emAfEndpoints[index].endpointType = ep;
|
@@ -642,10 +667,20 @@ Status emAfReadOrWriteAttribute(const EmberAfAttributeSearchRecord * attRecord,
|
642 | 667 | // Is the attribute externally stored?
|
643 | 668 | if (am->mask & MATTER_ATTRIBUTE_FLAG_EXTERNAL_STORAGE)
|
644 | 669 | {
|
645 |
| - return (write ? emberAfExternalAttributeWriteCallback(attRecord->endpoint, attRecord->clusterId, |
646 |
| - am, buffer) |
647 |
| - : emberAfExternalAttributeReadCallback(attRecord->endpoint, attRecord->clusterId, |
648 |
| - am, buffer, emberAfAttributeSize(am))); |
| 670 | + if (write) |
| 671 | + { |
| 672 | + return emberAfExternalAttributeWriteCallback(attRecord->endpoint, attRecord->clusterId, am, |
| 673 | + buffer); |
| 674 | + } |
| 675 | + |
| 676 | + if (readLength < emberAfAttributeSize(am)) |
| 677 | + { |
| 678 | + // Prevent a potential buffer overflow |
| 679 | + return Status::ResourceExhausted; |
| 680 | + } |
| 681 | + |
| 682 | + return emberAfExternalAttributeReadCallback(attRecord->endpoint, attRecord->clusterId, am, |
| 683 | + buffer, emberAfAttributeSize(am)); |
649 | 684 | }
|
650 | 685 |
|
651 | 686 | // Internal storage is only supported for fixed endpoints
|
|
0 commit comments