Skip to content

Commit

Permalink
Merge pull request #11 from zsmartsystems/add_len_check_max
Browse files Browse the repository at this point in the history 
Fix length so that it won't read past end of packet. Add user_code test.
  • Loading branch information
@cdjackson
cdjackson authored Apr 23, 2017
2 parents 5436614 + 4d35177 commit 9c6571c
Show file tree
Hide file tree
Showing 13 changed files with 238 additions and 120 deletions.
14 changes: 8 additions & 6 deletions ...e/src/main/java/com/zsmartsystems/zwave/commandclass/impl/CommandClassGroupingNameV1.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ static public byte[] getGroupingNameSet(Integer groupingIdentifier, Integer char
// Process 'Grouping Name'
if (groupingName != null) {
if (groupingName.length > 16) {
throw new IllegalArgumentException("Length of array groupingName exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array groupingName exceeds maximum length of 16 bytes");
}
try {
outputData.write(groupingName);
Expand Down Expand Up @@ -114,8 +114,9 @@ public static Map<String, Object> handleGroupingNameSet(byte[] payload) {
response.put("CHAR_PRESENTATION", Integer.valueOf(payload[3] & 0x07));

// Process 'Grouping Name'
byte[] valGroupingName = new byte[16];
for (int cntGroupingName = 0; cntGroupingName < 16; cntGroupingName++) {
int lenGroupingName = Math.min(16, payload.length - 4);
byte[] valGroupingName = new byte[lenGroupingName];
for (int cntGroupingName = 0; cntGroupingName < lenGroupingName; cntGroupingName++) {
valGroupingName[cntGroupingName] = payload[4 + cntGroupingName];
}
response.put("GROUPING_NAME", valGroupingName);
Expand Down Expand Up @@ -198,7 +199,7 @@ static public byte[] getGroupingNameReport(Integer groupingIdentifier, Integer c
// Process 'Grouping Name'
if (groupingName != null) {
if (groupingName.length > 16) {
throw new IllegalArgumentException("Length of array groupingName exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array groupingName exceeds maximum length of 16 bytes");
}
try {
outputData.write(groupingName);
Expand Down Expand Up @@ -236,8 +237,9 @@ public static Map<String, Object> handleGroupingNameReport(byte[] payload) {
response.put("CHAR_PRESENTATION", Integer.valueOf(payload[3] & 0x07));

// Process 'Grouping Name'
byte[] valGroupingName = new byte[16];
for (int cntGroupingName = 0; cntGroupingName < 16; cntGroupingName++) {
int lenGroupingName = Math.min(16, payload.length - 4);
byte[] valGroupingName = new byte[lenGroupingName];
for (int cntGroupingName = 0; cntGroupingName < lenGroupingName; cntGroupingName++) {
valGroupingName[cntGroupingName] = payload[4 + cntGroupingName];
}
response.put("GROUPING_NAME", valGroupingName);
Expand Down
21 changes: 12 additions & 9 deletions .../src/main/java/com/zsmartsystems/zwave/commandclass/impl/CommandClassIpAssociationV1.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ static public byte[] getIpAssociationSet(Integer groupingIdentifier, byte[] ipv6
// Process 'IPv6 Address'
if (ipv6Address != null) {
if (ipv6Address.length > 16) {
throw new IllegalArgumentException("Length of array ipv6Address exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array ipv6Address exceeds maximum length of 16 bytes");
}
try {
outputData.write(ipv6Address);
Expand Down Expand Up @@ -115,8 +115,9 @@ public static Map<String, Object> handleIpAssociationSet(byte[] payload) {
response.put("GROUPING_IDENTIFIER", Integer.valueOf(payload[2]));

// Process 'IPv6 Address'
byte[] valIpv6Address = new byte[16];
for (int cntIpv6Address = 0; cntIpv6Address < 16; cntIpv6Address++) {
int lenIpv6Address = Math.min(16, payload.length - 3);
byte[] valIpv6Address = new byte[lenIpv6Address];
for (int cntIpv6Address = 0; cntIpv6Address < lenIpv6Address; cntIpv6Address++) {
valIpv6Address[cntIpv6Address] = payload[3 + cntIpv6Address];
}
response.put("IPV6_ADDRESS", valIpv6Address);
Expand Down Expand Up @@ -216,7 +217,7 @@ static public byte[] getIpAssociationReport(Integer groupingIdentifier, Integer
// Process 'IPv6 Address'
if (ipv6Address != null) {
if (ipv6Address.length > 16) {
throw new IllegalArgumentException("Length of array ipv6Address exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array ipv6Address exceeds maximum length of 16 bytes");
}
try {
outputData.write(ipv6Address);
Expand Down Expand Up @@ -262,8 +263,9 @@ public static Map<String, Object> handleIpAssociationReport(byte[] payload) {
response.put("ACTUAL_NODES", Integer.valueOf(payload[4]));

// Process 'IPv6 Address'
byte[] valIpv6Address = new byte[16];
for (int cntIpv6Address = 0; cntIpv6Address < 16; cntIpv6Address++) {
int lenIpv6Address = Math.min(16, payload.length - 5);
byte[] valIpv6Address = new byte[lenIpv6Address];
for (int cntIpv6Address = 0; cntIpv6Address < lenIpv6Address; cntIpv6Address++) {
valIpv6Address[cntIpv6Address] = payload[5 + cntIpv6Address];
}
response.put("IPV6_ADDRESS", valIpv6Address);
Expand Down Expand Up @@ -299,7 +301,7 @@ static public byte[] getIpAssociationRemove(Integer groupingIdentifier, byte[] i
// Process 'IPv6 Address'
if (ipv6Address != null) {
if (ipv6Address.length > 16) {
throw new IllegalArgumentException("Length of array ipv6Address exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array ipv6Address exceeds maximum length of 16 bytes");
}
try {
outputData.write(ipv6Address);
Expand Down Expand Up @@ -337,8 +339,9 @@ public static Map<String, Object> handleIpAssociationRemove(byte[] payload) {
response.put("GROUPING_IDENTIFIER", Integer.valueOf(payload[2]));

// Process 'IPv6 Address'
byte[] valIpv6Address = new byte[16];
for (int cntIpv6Address = 0; cntIpv6Address < 16; cntIpv6Address++) {
int lenIpv6Address = Math.min(16, payload.length - 3);
byte[] valIpv6Address = new byte[lenIpv6Address];
for (int cntIpv6Address = 0; cntIpv6Address < lenIpv6Address; cntIpv6Address++) {
valIpv6Address[cntIpv6Address] = payload[3 + cntIpv6Address];
}
response.put("IPV6_ADDRESS", valIpv6Address);
Expand Down
14 changes: 8 additions & 6 deletions ....zwave/src/main/java/com/zsmartsystems/zwave/commandclass/impl/CommandClassMailboxV1.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ static public byte[] getMailboxConfigurationSet(String mode, byte[] forwardingDe
// Process 'Forwarding Destination IPv6 Address'
if (forwardingDestinationIpv6Address != null) {
if (forwardingDestinationIpv6Address.length > 16) {
throw new IllegalArgumentException("Length of array forwardingDestinationIpv6Address exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array forwardingDestinationIpv6Address exceeds maximum length of 16 bytes");
}
try {
outputData.write(forwardingDestinationIpv6Address);
Expand Down Expand Up @@ -195,8 +195,9 @@ public static Map<String, Object> handleMailboxConfigurationSet(byte[] payload)
}

// Process 'Forwarding Destination IPv6 Address'
byte[] valForwardingDestinationIpv6Address = new byte[16];
for (int cntForwardingDestinationIpv6Address = 0; cntForwardingDestinationIpv6Address < 16; cntForwardingDestinationIpv6Address++) {
int lenForwardingDestinationIpv6Address = Math.min(16, payload.length - 3);
byte[] valForwardingDestinationIpv6Address = new byte[lenForwardingDestinationIpv6Address];
for (int cntForwardingDestinationIpv6Address = 0; cntForwardingDestinationIpv6Address < lenForwardingDestinationIpv6Address; cntForwardingDestinationIpv6Address++) {
valForwardingDestinationIpv6Address[cntForwardingDestinationIpv6Address] = payload[3 + cntForwardingDestinationIpv6Address];
}
response.put("FORWARDING_DESTINATION_IPV6_ADDRESS", valForwardingDestinationIpv6Address);
Expand Down Expand Up @@ -267,7 +268,7 @@ static public byte[] getMailboxConfigurationReport(String mode, String supported
// Process 'Forwarding Destination IPv6 Address'
if (forwardingDestinationIpv6Address != null) {
if (forwardingDestinationIpv6Address.length > 16) {
throw new IllegalArgumentException("Length of array forwardingDestinationIpv6Address exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array forwardingDestinationIpv6Address exceeds maximum length of 16 bytes");
}
try {
outputData.write(forwardingDestinationIpv6Address);
Expand Down Expand Up @@ -333,8 +334,9 @@ public static Map<String, Object> handleMailboxConfigurationReport(byte[] payloa
response.put("MAILBOX_CAPACITY", Integer.valueOf(((payload[3] & 0xff) << 8) + (payload[4] & 0xff)));

// Process 'Forwarding Destination IPv6 Address'
byte[] valForwardingDestinationIpv6Address = new byte[16];
for (int cntForwardingDestinationIpv6Address = 0; cntForwardingDestinationIpv6Address < 16; cntForwardingDestinationIpv6Address++) {
int lenForwardingDestinationIpv6Address = Math.min(16, payload.length - 5);
byte[] valForwardingDestinationIpv6Address = new byte[lenForwardingDestinationIpv6Address];
for (int cntForwardingDestinationIpv6Address = 0; cntForwardingDestinationIpv6Address < lenForwardingDestinationIpv6Address; cntForwardingDestinationIpv6Address++) {
valForwardingDestinationIpv6Address[cntForwardingDestinationIpv6Address] = payload[5 + cntForwardingDestinationIpv6Address];
}
response.put("FORWARDING_DESTINATION_IPV6_ADDRESS", valForwardingDestinationIpv6Address);
Expand Down
14 changes: 8 additions & 6 deletions .../java/com/zsmartsystems/zwave/commandclass/impl/CommandClassNetworkManagementBasicV2.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -243,7 +243,7 @@ static public byte[] getLearnModeSetStatus(Integer seqNo, String status, Integer
// Process 'DSK'
if (dsk != null) {
if (dsk.length > 16) {
throw new IllegalArgumentException("Length of array dsk exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array dsk exceeds maximum length of 16 bytes");
}
try {
outputData.write(dsk);
Expand Down Expand Up @@ -289,8 +289,9 @@ public static Map<String, Object> handleLearnModeSetStatus(byte[] payload) {
response.put("GRANTED_KEYS", Integer.valueOf(payload[6]));

// Process 'DSK'
byte[] valDsk = new byte[16];
for (int cntDsk = 0; cntDsk < 16; cntDsk++) {
int lenDsk = Math.min(16, payload.length - 7);
byte[] valDsk = new byte[lenDsk];
for (int cntDsk = 0; cntDsk < lenDsk; cntDsk++) {
valDsk[cntDsk] = payload[7 + cntDsk];
}
response.put("DSK", valDsk);
Expand Down Expand Up @@ -710,7 +711,7 @@ static public byte[] getDskReport(Integer seqNo, byte[] dsk) {
// Process 'DSK'
if (dsk != null) {
if (dsk.length > 16) {
throw new IllegalArgumentException("Length of array dsk exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array dsk exceeds maximum length of 16 bytes");
}
try {
outputData.write(dsk);
Expand Down Expand Up @@ -744,8 +745,9 @@ public static Map<String, Object> handleDskReport(byte[] payload) {
response.put("SEQ_NO", Integer.valueOf(payload[2]));

// Process 'DSK'
byte[] valDsk = new byte[16];
for (int cntDsk = 0; cntDsk < 16; cntDsk++) {
int lenDsk = Math.min(16, payload.length - 3);
byte[] valDsk = new byte[lenDsk];
for (int cntDsk = 0; cntDsk < lenDsk; cntDsk++) {
valDsk[cntDsk] = payload[3 + cntDsk];
}
response.put("DSK", valDsk);
Expand Down
7 changes: 4 additions & 3 deletions ...a/com/zsmartsystems/zwave/commandclass/impl/CommandClassNetworkManagementInclusionV2.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1613,7 +1613,7 @@ static public byte[] getNodeAddDskReport(Integer seqNo, Integer inputDskLength,
// Process 'DSK'
if (dsk != null) {
if (dsk.length > 16) {
throw new IllegalArgumentException("Length of array dsk exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array dsk exceeds maximum length of 16 bytes");
}
try {
outputData.write(dsk);
Expand Down Expand Up @@ -1651,8 +1651,9 @@ public static Map<String, Object> handleNodeAddDskReport(byte[] payload) {
response.put("INPUT_DSK_LENGTH", Integer.valueOf(payload[3] & 0x0F));

// Process 'DSK'
byte[] valDsk = new byte[16];
for (int cntDsk = 0; cntDsk < 16; cntDsk++) {
int lenDsk = Math.min(16, payload.length - 4);
byte[] valDsk = new byte[lenDsk];
for (int cntDsk = 0; cntDsk < lenDsk; cntDsk++) {
valDsk[cntDsk] = payload[4 + cntDsk];
}
response.put("DSK", valDsk);
Expand Down
28 changes: 16 additions & 12 deletions ...ave/src/main/java/com/zsmartsystems/zwave/commandclass/impl/CommandClassNodeNamingV1.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ static public byte[] getNodeNamingNodeNameSet(Integer charPresentation, byte[] n
// Process 'Node name char'
if (nodeNameChar != null) {
if (nodeNameChar.length > 16) {
throw new IllegalArgumentException("Length of array nodeNameChar exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array nodeNameChar exceeds maximum length of 16 bytes");
}
try {
outputData.write(nodeNameChar);
Expand Down Expand Up @@ -118,8 +118,9 @@ public static Map<String, Object> handleNodeNamingNodeNameSet(byte[] payload) {
response.put("CHAR_PRESENTATION", Integer.valueOf(payload[2] & 0x07));

// Process 'Node name char'
byte[] valNodeNameChar = new byte[16];
for (int cntNodeNameChar = 0; cntNodeNameChar < 16; cntNodeNameChar++) {
int lenNodeNameChar = Math.min(16, payload.length - 3);
byte[] valNodeNameChar = new byte[lenNodeNameChar];
for (int cntNodeNameChar = 0; cntNodeNameChar < lenNodeNameChar; cntNodeNameChar++) {
valNodeNameChar[cntNodeNameChar] = payload[3 + cntNodeNameChar];
}
response.put("NODE_NAME_CHAR", valNodeNameChar);
Expand Down Expand Up @@ -185,7 +186,7 @@ static public byte[] getNodeNamingNodeNameReport(Integer charPresentation, byte[
// Process 'Node name char'
if (nodeNameChar != null) {
if (nodeNameChar.length > 16) {
throw new IllegalArgumentException("Length of array nodeNameChar exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array nodeNameChar exceeds maximum length of 16 bytes");
}
try {
outputData.write(nodeNameChar);
Expand Down Expand Up @@ -219,8 +220,9 @@ public static Map<String, Object> handleNodeNamingNodeNameReport(byte[] payload)
response.put("CHAR_PRESENTATION", Integer.valueOf(payload[2] & 0x07));

// Process 'Node name char'
byte[] valNodeNameChar = new byte[16];
for (int cntNodeNameChar = 0; cntNodeNameChar < 16; cntNodeNameChar++) {
int lenNodeNameChar = Math.min(16, payload.length - 3);
byte[] valNodeNameChar = new byte[lenNodeNameChar];
for (int cntNodeNameChar = 0; cntNodeNameChar < lenNodeNameChar; cntNodeNameChar++) {
valNodeNameChar[cntNodeNameChar] = payload[3 + cntNodeNameChar];
}
response.put("NODE_NAME_CHAR", valNodeNameChar);
Expand Down Expand Up @@ -252,7 +254,7 @@ static public byte[] getNodeNamingNodeLocationSet(Integer charPresentation, byte
// Process 'Node location char'
if (nodeLocationChar != null) {
if (nodeLocationChar.length > 16) {
throw new IllegalArgumentException("Length of array nodeLocationChar exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array nodeLocationChar exceeds maximum length of 16 bytes");
}
try {
outputData.write(nodeLocationChar);
Expand Down Expand Up @@ -286,8 +288,9 @@ public static Map<String, Object> handleNodeNamingNodeLocationSet(byte[] payload
response.put("CHAR_PRESENTATION", Integer.valueOf(payload[2] & 0x07));

// Process 'Node location char'
byte[] valNodeLocationChar = new byte[16];
for (int cntNodeLocationChar = 0; cntNodeLocationChar < 16; cntNodeLocationChar++) {
int lenNodeLocationChar = Math.min(16, payload.length - 3);
byte[] valNodeLocationChar = new byte[lenNodeLocationChar];
for (int cntNodeLocationChar = 0; cntNodeLocationChar < lenNodeLocationChar; cntNodeLocationChar++) {
valNodeLocationChar[cntNodeLocationChar] = payload[3 + cntNodeLocationChar];
}
response.put("NODE_LOCATION_CHAR", valNodeLocationChar);
Expand Down Expand Up @@ -353,7 +356,7 @@ static public byte[] getNodeNamingNodeLocationReport(Integer charPresentation, b
// Process 'Node location char'
if (nodeLocationChar != null) {
if (nodeLocationChar.length > 16) {
throw new IllegalArgumentException("Length of array nodeLocationChar exceeds maximum length of 16 bytes
throw new IllegalArgumentException("Length of array nodeLocationChar exceeds maximum length of 16 bytes");
}
try {
outputData.write(nodeLocationChar);
Expand Down Expand Up @@ -387,8 +390,9 @@ public static Map<String, Object> handleNodeNamingNodeLocationReport(byte[] payl
response.put("CHAR_PRESENTATION", Integer.valueOf(payload[2] & 0x07));

// Process 'Node location char'
byte[] valNodeLocationChar = new byte[16];
for (int cntNodeLocationChar = 0; cntNodeLocationChar < 16; cntNodeLocationChar++) {
int lenNodeLocationChar = Math.min(16, payload.length - 3);
byte[] valNodeLocationChar = new byte[lenNodeLocationChar];
for (int cntNodeLocationChar = 0; cntNodeLocationChar < lenNodeLocationChar; cntNodeLocationChar++) {
valNodeLocationChar[cntNodeLocationChar] = payload[3 + cntNodeLocationChar];
}
response.put("NODE_LOCATION_CHAR", valNodeLocationChar);
Expand Down
Loading

0 comments on commit 9c6571c

Please sign in to comment.