Fix Null Pointer Dereference in TCP Packet Handling

BoB13-Matter · BoB13-Matter · commit 404db44eedcf · 2024-12-07T00:12:29.000+09:00
diff --git a/src/transport/raw/TCP.cpp b/src/transport/raw/TCP.cpp
@@ -344,6 +344,7 @@ CHIP_ERROR TCPBase::ProcessReceivedBuffer(Inet::TCPEndPoint * endPoint, const Pe
             return CHIP_NO_ERROR;
         }
         state->mReceived.Consume(kPacketSizeBytes);
+        VerifyOrReturnError(!state->mReceived.IsNull(), CHIP_ERROR_MESSAGE_INCOMPLETE);
         ReturnErrorOnFailure(ProcessSingleMessage(peerAddress, state, messageSize));
     }
 

Original file line number	Diff line number	Diff line change
`@@ -344,6 +344,7 @@ CHIP_ERROR TCPBase::ProcessReceivedBuffer(Inet::TCPEndPoint * endPoint, const Pe`
`344`	`344`	`return CHIP_NO_ERROR;`
`345`	`345`	`}`
`346`	`346`	`state->mReceived.Consume(kPacketSizeBytes);`
	`347`	`+ VerifyOrReturnError(!state->mReceived.IsNull(), CHIP_ERROR_MESSAGE_INCOMPLETE);`
`347`	`348`	`ReturnErrorOnFailure(ProcessSingleMessage(peerAddress, state, messageSize));`
`348`	`349`	`}`
`349`	`350`