Skip to content

Commit 080d6c3

Browse files
committed
Close TCP connection when received message size is too large.
When the framing length value of a received message is larger than what the local node can process, abort the connection with the peer. The peer was already aware of the max length this node was willing to receive during its TCP advertisement. Fixes project-chip#33307.
1 parent 2005be9 commit 080d6c3

File tree

2 files changed

+7
-2
lines changed

2 files changed

+7
-2
lines changed

src/transport/raw/TCP.cpp

+4-1
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,10 @@ CHIP_ERROR TCPBase::ProcessReceivedBuffer(Inet::TCPEndPoint * endPoint, const Pe
331331
uint32_t messageSize = LittleEndian::Get32(messageSizeBuf);
332332
if (messageSize >= kMaxTCPMessageSize)
333333
{
334-
// This message is too long for upper layers.
334+
// Message is too big for this node to process. Disconnect with peer.
335+
ChipLogError(Inet, "Received TCP message of length %" PRIu32 " exceeds limit.", messageSize);
336+
CloseConnectionInternal(state, CHIP_ERROR_MESSAGE_TOO_LONG, SuppressCallback::No);
337+
335338
return CHIP_ERROR_MESSAGE_TOO_LONG;
336339
}
337340
// The subtraction will not underflow because we successfully read kPacketSizeBytes.

src/transport/raw/tests/TestTCP.cpp

+3-1
Original file line numberDiff line numberDiff line change
@@ -682,7 +682,9 @@ TEST_F(TestTCP, CheckProcessReceivedBuffer)
682682
EXPECT_EQ(err, CHIP_ERROR_MESSAGE_TOO_LONG);
683683
EXPECT_EQ(gMockTransportMgrDelegate.mReceiveHandlerCallCount, 0);
684684

685-
gMockTransportMgrDelegate.DisconnectTest(tcp, addr);
685+
// The receipt of a message exceeding the allowed size should have
686+
// closed the connection.
687+
EXPECT_EQ(TestAccess::GetEndpoint(state), nullptr);
686688
}
687689

688690
} // namespace

0 commit comments

Comments
 (0)