zx/quisk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix out-of-bounds accesses and a leak in quisk.c and afedrinet_io.c

Browse Source 
- afedrinet_io.c open_rx_udp: use snprintf so a long ip string cannot
  overflow the 128-byte stack buffer.
- quisk.c set_multirx_mode, set_multirx_freq: reject a negative index.
- quisk.c set_multirx_play_channel: treat a negative channel like an
  out-of-range one.
- quisk.c measure_freq: keep ipeak inside [1, fft_size - 2] so that
  fft_average[ipeak - 1] and fft_average[ipeak + 1] stay in bounds when
  no peak is found.
- quisk.c record_app: free the previous multirx_fft_next_samples buffer
  before allocating a new one, like fft_window and current_graph.
This commit is contained in:
argusSecurityBot
2026-10-20 16:46:24 +00:00
parent c2304b23ee
commit faaeda54e5
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
afedrinet/afedrinet_io.c
+2 -2
View File
@@ -128,10 +128,10 @@ static PyObject * open_rx_udp(const char * ip, int port)
shutdown(rx_udp_socket, QUISK_SHUT_BOTH);
close(rx_udp_socket);
rx_udp_socket = INVALID_SOCKET;
sprintf(buf, "Failed to connect to UDP %s port %u", ip, port);
snprintf(buf, sizeof(buf), "Failed to connect to UDP %s port %u", ip, port);
}
else {
sprintf(buf, "Capture from UDP %s port %u", ip, port);
snprintf(buf, sizeof(buf), "Capture from UDP %s port %u", ip, port);
#if DEBUG_IO
if (getsockopt(rx_udp_socket, SOL_SOCKET, SO_RCVBUF, (char *)&intbuf, &bufsize) == 0)
{
quisk.c
+9 -3
View File
@@ -4830,7 +4830,7 @@ static PyObject * set_multirx_mode(PyObject * self, PyObject * args)
if (!PyArg_ParseTuple (args, "ii", &index, &mode))
return NULL;
if (index < QUISK_MAX_SUB_RECEIVERS)
if (index >= 0 && index < QUISK_MAX_SUB_RECEIVERS)
multirx_mode[index] = mode;
Py_INCREF (Py_None);
return Py_None;
@@ -4842,7 +4842,7 @@ static PyObject * set_multirx_freq(PyObject * self, PyObject * args)
if (!PyArg_ParseTuple (args, "ii", &index, &freq))
return NULL;
if (index < QUISK_MAX_SUB_RECEIVERS)
if (index >= 0 && index < QUISK_MAX_SUB_RECEIVERS)
multirx_freq[index] = freq;
Py_INCREF (Py_None);
return Py_None;
@@ -4860,7 +4860,7 @@ static PyObject * set_multirx_play_channel(PyObject * self, PyObject * args)
{
if (!PyArg_ParseTuple (args, "i", &multirx_play_channel))
return NULL;
if (multirx_play_channel >= QUISK_MAX_SUB_RECEIVERS)
if (multirx_play_channel < 0 || multirx_play_channel >= QUISK_MAX_SUB_RECEIVERS)
multirx_play_channel = -1;
Py_INCREF (Py_None);
return Py_None;
@@ -5638,6 +5638,10 @@ static void measure_freq(complex double * cSamples, int nSamples, int srate)
ipeak = i;
}
}
if (ipeak < 1)
ipeak = 1;
else if (ipeak > fft_size - 2)
ipeak = fft_size - 2;
c3 = 1.36 * (fft_average[ipeak+1] - fft_average[ipeak - 1]) / (fft_average[ipeak-1] + fft_average[ipeak] + fft_average[ipeak+1]);
freq = srate * (2 * (ipeak + c3) - fft_size) / 2 / fft_size;
freq += rx_tune_freq;
@@ -6006,6 +6010,8 @@ static PyObject * record_app(PyObject * self, PyObject * args)
}
// Initialize plan for multirx FFT
multirx_fft_width = multirx_data_width * MULTIRX_FFT_MULT; // Use larger FFT than graph size
if (multirx_fft_next_samples)
free(multirx_fft_next_samples);
multirx_fft_next_samples = (fftw_complex *)malloc(multirx_fft_width * sizeof(fftw_complex));
multirx_fft_next_plan = quisk_create_or_cache_fftw_plan_dft_1d(multirx_fft_width, multirx_fft_next_samples, multirx_fft_next_samples, FFTW_FORWARD, FFTW_MEASURE);
if (current_graph)