1
1
/*
2
2
* This file has been copied from the cddl-gen submodule.
3
- * Commit 8f9358a0b4b0e9b0cd579f0988056ef0b60760e4
3
+ * Commit 9f77837f9950da1633d22abf6181a830521a6688
4
4
*/
5
5
6
6
/*
@@ -126,6 +126,7 @@ static bool value_extract(cbor_state_t *state,
126
126
127
127
static bool int32_decode (cbor_state_t * state , int32_t * result )
128
128
{
129
+ FAIL_IF (state -> payload >= state -> payload_end );
129
130
uint8_t major_type = MAJOR_TYPE (* state -> payload );
130
131
uint32_t uint_result ;
131
132
int32_t int_result ;
@@ -155,6 +156,7 @@ static bool int32_decode(cbor_state_t *state, int32_t *result)
155
156
156
157
bool intx32_decode (cbor_state_t * state , int32_t * result )
157
158
{
159
+ FAIL_IF (state -> payload >= state -> payload_end );
158
160
uint8_t major_type = MAJOR_TYPE (* state -> payload );
159
161
160
162
if (major_type != CBOR_MAJOR_TYPE_PINT
@@ -197,6 +199,7 @@ static bool uint32_decode(cbor_state_t *state, uint32_t *result)
197
199
198
200
bool uintx32_decode (cbor_state_t * state , uint32_t * result )
199
201
{
202
+ FAIL_IF (state -> payload >= state -> payload_end );
200
203
uint8_t major_type = MAJOR_TYPE (* state -> payload );
201
204
202
205
if (major_type != CBOR_MAJOR_TYPE_PINT ) {
@@ -233,6 +236,7 @@ bool uintx32_expect_union(cbor_state_t *state, uint32_t result)
233
236
static bool strx_start_decode (cbor_state_t * state ,
234
237
cbor_string_type_t * result , cbor_major_type_t exp_major_type )
235
238
{
239
+ FAIL_IF (state -> payload >= state -> payload_end );
236
240
uint8_t major_type = MAJOR_TYPE (* state -> payload );
237
241
238
242
if (major_type != exp_major_type ) {
@@ -243,10 +247,10 @@ static bool strx_start_decode(cbor_state_t *state,
243
247
FAIL ();
244
248
}
245
249
246
- if (( state -> payload + result -> len ) > state -> payload_end ) {
250
+ if (result -> len > ( state -> payload_end - state -> payload ) ) {
247
251
cbor_print ("error: 0x%x > 0x%x\r\n" ,
248
- (uint32_t )( state -> payload + result -> len ) ,
249
- (uint32_t )state -> payload_end );
252
+ (uint32_t )result -> len ,
253
+ (uint32_t )( state -> payload_end - state -> payload ) );
250
254
FAIL_RESTORE ();
251
255
}
252
256
@@ -264,6 +268,7 @@ bool bstrx_cbor_start_decode(cbor_state_t *state, cbor_string_type_t *result)
264
268
FAIL_RESTORE ();
265
269
}
266
270
271
+ /* Overflow is checked in strx_start_decode() */
267
272
state -> payload_end = result -> value + result -> len ;
268
273
return true;
269
274
}
@@ -290,6 +295,7 @@ bool strx_decode(cbor_state_t *state, cbor_string_type_t *result,
290
295
FAIL ();
291
296
}
292
297
298
+ /* Overflow is checked in strx_start_decode() */
293
299
(state -> payload ) += result -> len ;
294
300
return true;
295
301
}
@@ -338,8 +344,9 @@ bool tstrx_expect(cbor_state_t *state, cbor_string_type_t *result)
338
344
static bool list_map_start_decode (cbor_state_t * state ,
339
345
cbor_major_type_t exp_major_type )
340
346
{
341
- uint32_t new_elem_count ;
347
+ FAIL_IF ( state -> payload >= state -> payload_end ) ;
342
348
uint8_t major_type = MAJOR_TYPE (* state -> payload );
349
+ uint32_t new_elem_count ;
343
350
344
351
if (major_type != exp_major_type ) {
345
352
FAIL ();
@@ -400,6 +407,7 @@ bool map_end_decode(cbor_state_t *state)
400
407
401
408
static bool primx_decode (cbor_state_t * state , uint32_t * result )
402
409
{
410
+ FAIL_IF (state -> payload >= state -> payload_end );
403
411
uint8_t major_type = MAJOR_TYPE (* state -> payload );
404
412
405
413
if (major_type != CBOR_MAJOR_TYPE_PRIM ) {
@@ -468,6 +476,7 @@ bool boolx_expect(cbor_state_t *state, bool result)
468
476
469
477
bool double_decode (cbor_state_t * state , double * result )
470
478
{
479
+ FAIL_IF (state -> payload >= state -> payload_end );
471
480
uint8_t major_type = MAJOR_TYPE (* state -> payload );
472
481
473
482
if (major_type != CBOR_MAJOR_TYPE_PRIM ) {
@@ -501,6 +510,7 @@ bool any_decode(cbor_state_t *state, void *result)
501
510
cbor_assert (result == NULL ,
502
511
"'any' type cannot be returned, only skipped.\n" );
503
512
513
+ FAIL_IF (state -> payload >= state -> payload_end );
504
514
uint8_t major_type = MAJOR_TYPE (* state -> payload );
505
515
uint32_t value ;
506
516
uint32_t num_decode ;
@@ -545,6 +555,7 @@ bool any_decode(cbor_state_t *state, void *result)
545
555
546
556
bool tag_decode (cbor_state_t * state , uint32_t * result )
547
557
{
558
+ FAIL_IF (state -> payload >= state -> payload_end );
548
559
uint8_t major_type = MAJOR_TYPE (* state -> payload );
549
560
550
561
if (major_type != CBOR_MAJOR_TYPE_TAG ) {
0 commit comments