Skip to content

Proposed fix for crash in calculateFirmwareRanges() due to division by zero #443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 29, 2021

Conversation

dinesharjani
Copy link
Contributor

If the maxSize UInt32 is zero, the internal division inside calculateFirmwareRanges() will crash both the framework and the caller app.

…y zero

If the maxSize UInt32 is zero, the internal division inside calculateFirmwareRanges() will crash both the framework and the caller app.
@dinesharjani dinesharjani requested a review from philips77 July 29, 2021 12:48
@dinesharjani
Copy link
Contributor Author

Attached crash report sourced from nRF Connect for iOS 2.4.12:

Thread 7 name:
Thread 7 Crashed:
0 iOSDFULibrary 0x00000001012eea20 Swift runtime failure: Division by zero + 0 (SecureDFUExecutor.swift:0)
1 iOSDFULibrary 0x00000001012eea20 SecureDFUExecutor.calculateFirmwareRanges(:) + 772 (SecureDFUExecutor.swift:411)
2 iOSDFULibrary 0x00000001012ee864 SecureDFUExecutor.calculateFirmwareRanges(
:) + 328 (SecureDFUExecutor.swift:0)
3 iOSDFULibrary 0x00000001012edb78 SecureDFUExecutor.peripheralDidSendDataObjectInfo(maxLen:offset:crc:) + 72 (SecureDFUExecutor.swift:289)
4 iOSDFULibrary 0x00000001012f5500 closure #1 in SecureDFUPeripheral.readDataObjectInfo() + 84 (SecureDFUPeripheral.swift:165)
5 iOSDFULibrary 0x00000001012ebaec specialized SecureDFUControlPoint.peripheral(:didUpdateValueFor:error:) + 1444 (SecureDFUControlPoint.swift:568)
6 iOSDFULibrary 0x00000001012ea220 @objc SecureDFUControlPoint.peripheral(
:didUpdateNotificationStateFor:error:) + 108
7 CoreBluetooth 0x00000001b5b98c44 -[CBPeripheral handleAttributeEvent:args:attributeSelector:delegateSelector:delegateFlag:] + 228 (CBPeripheral.m:793)
8 CoreBluetooth 0x00000001b5b98db0 -[CBPeripheral handleCharacteristicEvent:characteristicSelector:delegateSelector:delegateFlag:] + 124 (CBPeripheral.m:815)
9 CoreBluetooth 0x00000001b5b9536c -[CBPeripheral handleMsg:args:] + 364 (CBPeripheral.m:229)
10 CoreBluetooth 0x00000001b5b8a150 -[CBCentralManager handleMsg:args:] + 196 (CBCentralManager.m:1234)
11 CoreBluetooth 0x00000001b5bb1f78 -[CBManager xpcConnectionDidReceiveMsg:args:] + 208 (CBManager.m:273)
12 CoreBluetooth 0x00000001b5ba5874 __30-[CBXpcConnection _handleMsg:]_block_invoke + 68 (CBXpcConnection.m:234)
13 libdispatch.dylib 0x000000019bf45a84 _dispatch_call_block_and_release + 32 (init.c:1466)
14 libdispatch.dylib 0x000000019bf4781c _dispatch_client_callout + 20 (object.m:559)
15 libdispatch.dylib 0x000000019bf4f004 _dispatch_lane_serial_drain + 620 (inline_internal.h:2557)
16 libdispatch.dylib 0x000000019bf4fc34 _dispatch_lane_invoke + 456 (queue.c:3862)
17 libdispatch.dylib 0x000000019bf4eecc _dispatch_lane_serial_drain + 308 (inline_internal.h:2598)
18 libdispatch.dylib 0x000000019bf4fc34 _dispatch_lane_invoke + 456 (queue.c:3862)
19 libdispatch.dylib 0x000000019bf4eecc _dispatch_lane_serial_drain + 308 (inline_internal.h:2598)
20 libdispatch.dylib 0x000000019bf4fc00 _dispatch_lane_invoke + 404 (queue.c:3862)
21 libdispatch.dylib 0x000000019bf5a4bc _dispatch_workloop_worker_thread + 764 (queue.c:6589)
22 libsystem_pthread.dylib 0x00000001e7ebe7a4 0x1e7ebb000 + 14244
23 libsystem_pthread.dylib 0x00000001e7ec574c 0x1e7ebb000 + 42828

@dinesharjani
Copy link
Contributor Author

I thought about fixing this crash in multiple ways, like changing the specific division and inserting a min(maxLen, 1) into it to ensure this doesn't happen again. However, if maxLength returned from the Device is zero, it means no Data is supported in return, so I don't consider the DFU Process can continue and it's worse to keep the code going as usual.

I'm open to fix this in any other way that @philips77 or anyone else considers to be better overall.

Copy link
Member

@philips77 philips77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The maxSize parameter is max size of an object. The message may say: Received invalid max size = 0.
Although, I think the issue comes from a fact that the device disconnects, or the value is somehow overwritten and the value gets 0ed. Either way, reporting an error here seems the right thing to do.

@philips77 philips77 merged commit 7442dd6 into develop Jul 29, 2021
@philips77 philips77 deleted the securedfuexecutor-divide-by-zero branch July 29, 2021 19:50
@philips77 philips77 restored the securedfuexecutor-divide-by-zero branch July 29, 2021 20:17
@philips77 philips77 deleted the securedfuexecutor-divide-by-zero branch July 29, 2021 20:19
philips77 added a commit that referenced this pull request Jul 29, 2021
…vide-by-zero-fix

Improved fix for crash fixed in #443
@philips77 philips77 mentioned this pull request Jul 30, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants