# This is a combination of 2 commits.

# This is the 1st commit message:

Check out of bounds for inactive type1 packet

# The commit message #2 will be skipped:

# fixup! Check out of bounds for inactive type1 packet

Author: magnusedgeware

CMakeLists.txt

@@ -50,6 +50,7 @@ add_executable(runUnitTestsEFP
         ${CMAKE_CURRENT_SOURCE_DIR}/unitTests/UnitTest21.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/unitTests/UnitTest22.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/unitTests/UnitTest23.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/unitTests/UnitTest24.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/unitTests/UnitTestHelpers.cpp
         )
 

ElasticFrameProtocol.cpp

@@ -167,6 +167,15 @@ ElasticFrameProtocolReceiver::unpackType1(const uint8_t *pSubPacket, size_t lPac
             pThisBucket->mActive = false;
             return ElasticFrameMessages::memoryAllocationError;
         }
+
+        if (pThisBucket->mOfFragmentNo < lType1Frame->hFragmentNo ||
+            lType1Frame->hOfFragmentNo != pThisBucket->mOfFragmentNo) {
+            EFP_LOGGER(true, LOGG_FATAL, "bufferOutOfBounds")
+            mBucketMap.erase(pThisBucket->mDeliveryOrder);
+            pThisBucket->mActive = false;
+            return ElasticFrameMessages::bufferOutOfBounds;
+        }
+
         std::copy_n(pSubPacket + sizeof(ElasticFrameType1), lPacketSize - sizeof(ElasticFrameType1),
                     pThisBucket->mBucketData->pFrameData + lInsertDataPointer);
         return ElasticFrameMessages::noError;

efp_c_api/main.c

@@ -42,7 +42,7 @@ void send_data_callback(const uint8_t *data, size_t size, uint8_t stream_id, voi
 }
 
 void receive_embedded_data_callback(uint8_t *data, size_t size, uint8_t data_type, uint64_t pts, void* ctx) {
-    printf("Got embedded data: %zu bytes size and of type %d pts: %lu\n", size, data_type, pts);
+    printf("Got embedded data: %zu bytes size and of type %d pts: %llu\n", size, data_type, pts);
     //In this example we know it's a string, print it.
     printf("Data: %s \n", data);
     printf("Context: %d \n\n", *(int*)ctx);
@@ -72,8 +72,8 @@ void receive_data_callback(uint8_t *data,
     printf("mFrameSize: %zu\n", size);
     printf("mDataContent: %d\n", data_content);
     printf("mBroken: %d\n", broken);
-    printf("mPts: %lu\n", pts);
-    printf("mDts: %lu\n", dts);
+    printf("mPts: %llu\n", pts);
+    printf("mDts: %llu\n", dts);
     printf("mCode: %d\n", code);
     printf("mStreamID: %d\n", stream_id);
     printf("mSource: %d\n", source);

unitTests/UnitTest24.cpp

@@ -0,0 +1,28 @@
+#include <gtest/gtest.h>
+
+#include <memory>
+
+#include "ElasticFrameProtocol.h"
+#include "ElasticInternal.h"
+#include "UnitTestHelpers.h"
+
+// UnitTest24
+// Test unpack type1 packet
+TEST(UnitTest24, UnpackType1) {
+  const size_t FRAME_SIZE = ((MTU - ElasticFrameProtocolSender::getType1Size()) * 5) + 12;
+  std::unique_ptr<ElasticFrameProtocolReceiver> myEFPReceiver =
+      std::make_unique<ElasticFrameProtocolReceiver>(50, 20);
+  ElasticFrameType1 lType1Frame;
+
+  // test with nice type1 packet
+  lType1Frame.hSuperFrameNo = 0;
+  lType1Frame.hFrameType = Frametype::type1;
+  ElasticFrameMessages result = myEFPReceiver->receiveFragmentFromPtr(reinterpret_cast<uint8_t*>(&lType1Frame), FRAME_SIZE, 0);
+  EXPECT_EQ(result, ElasticFrameMessages::noError);
+
+  // test with corrupt type1 packet
+  lType1Frame.hSuperFrameNo = 1;
+  lType1Frame.hFragmentNo = 12345;
+  result = myEFPReceiver->receiveFragmentFromPtr(reinterpret_cast<uint8_t*>(&lType1Frame), FRAME_SIZE, 0);
+  EXPECT_EQ(result, ElasticFrameMessages::bufferOutOfBounds);
+}