From 5790716a0bdc955b79e0a3c85445f56f5ae12f4d Mon Sep 17 00:00:00 2001
From: Bertrand Songis <bsongis@gmail.com>
Date: Sat, 12 Mar 2016 10:21:34 +0100
Subject: [PATCH] [Horus] Memory overflow check added in compress / uncompress
 methods to BACKUP RAM

---
 radio/src/storage/rambackup.cpp |  8 +++---
 radio/src/storage/rlc.cpp       | 49 +++++++++++++++++++++++++--------
 radio/src/storage/storage.h     |  4 +--
 3 files changed, 43 insertions(+), 18 deletions(-)

diff --git a/radio/src/storage/rambackup.cpp b/radio/src/storage/rambackup.cpp
index 14dcbcb0d..d61c8e4ea 100644
--- a/radio/src/storage/rambackup.cpp
+++ b/radio/src/storage/rambackup.cpp
@@ -50,14 +50,14 @@ void rambackupWrite()
 {
   copyRadioData(&ramBackupUncompressed.radio, &g_eeGeneral);
   copyModelData(&ramBackupUncompressed.model, &g_model);
-  ramBackup->size = compress(ramBackup->data, (const uint8_t *)&ramBackupUncompressed, sizeof(ramBackupUncompressed));
+  ramBackup->size = compress(ramBackup->data, 4094, (const uint8_t *)&ramBackupUncompressed, sizeof(ramBackupUncompressed));
   TRACE("RamBackupWrite sdsize=%d backupsize=%d rlcsize=%d", sizeof(ModelData)+sizeof(RadioData), sizeof(Backup::RamBackupUncompressed), ramBackup->size);
 
 #if 0
   // TODO move this code to non regression tests
   Backup::RamBackupUncompressed ramBackupRestored;
-  if (uncompress((uint8_t *)&ramBackupRestored, ramBackup->data, ramBackup->size) != sizeof(ramBackupUncompressed))
-    TRACE("ERROR size");
+  if (uncompress((uint8_t *)&ramBackupRestored, sizeof(ramBackupRestored), ramBackup->data, ramBackup->size) != sizeof(ramBackupUncompressed))
+    TRACE("ERROR uncompress");
   if (memcmp(&ramBackupUncompressed, &ramBackupRestored, sizeof(ramBackupUncompressed)) != 0)
     TRACE("ERROR restore");
 #endif
@@ -68,7 +68,7 @@ bool rambackupRestore()
   if (ramBackup->size == 0)
     return false;
 
-  if (uncompress((uint8_t *)&ramBackupUncompressed, ramBackup->data, ramBackup->size) != sizeof(ramBackupUncompressed))
+  if (uncompress((uint8_t *)&ramBackupUncompressed, sizeof(ramBackupUncompressed), ramBackup->data, ramBackup->size) != sizeof(ramBackupUncompressed))
     return false;
 
   memset(&g_eeGeneral, 0, sizeof(g_eeGeneral));
diff --git a/radio/src/storage/rlc.cpp b/radio/src/storage/rlc.cpp
index 595d39c2a..7ff3c3374 100644
--- a/radio/src/storage/rlc.cpp
+++ b/radio/src/storage/rlc.cpp
@@ -22,7 +22,13 @@
 #include <assert.h>
 #include "debug.h"
 
-unsigned int compress(uint8_t * dst, const uint8_t * src, unsigned int len)
+#define CHECK_DST_SIZE() \
+  if (cur-dst >= dstsize) { \
+    TRACE("RLC encoding size too big"); \
+    return 0; \
+  }
+
+unsigned int compress(uint8_t * dst, unsigned int dstsize, const uint8_t * src, unsigned int srcsize)
 {
   uint8_t * cur = dst;
   bool    run0   = (src[0] == 0);
@@ -31,28 +37,34 @@ unsigned int compress(uint8_t * dst, const uint8_t * src, unsigned int len)
 
   for (unsigned int i=1; 1; i++) {
     bool cur0 = (src[i] == 0);
-    if (i==len || cur0!=run0 || cnt==0x3f || (cnt0 && cnt==0xf)) {
+    if (i==srcsize || cur0!=run0 || cnt==0x3f || (cnt0 && cnt==0xf)) {
       if (run0) {
         assert(cnt0==0);
-        if (cnt<8 && i!=len)
+        if (cnt<8 && i!=srcsize) {
           cnt0 = cnt;
-        else
-          *cur++ = (cnt|0x40);
+        }
+        else {
+          CHECK_DST_SIZE();
+          *cur++ = (cnt | 0x40);
+        }
       }
       else {
         if (cnt0) {
+          CHECK_DST_SIZE();
           *cur++ = (0x80 | (cnt0<<4) | cnt);
           cnt0 = 0;
         }
         else {
+          CHECK_DST_SIZE();
           *cur++ = cnt;
         }
         for (int j=0; j<cnt; j++) {
+          CHECK_DST_SIZE();
           *cur++ = src[i - cnt + j];
         }
       }
       cnt = 0;
-      if (i==len) break;
+      if (i==srcsize) break;
       run0 = cur0;
     }
     cnt++;
@@ -61,7 +73,14 @@ unsigned int compress(uint8_t * dst, const uint8_t * src, unsigned int len)
   return cur-dst;
 }
 
-unsigned int uncompress(uint8_t * dst, const uint8_t * src, unsigned int len)
+#undef CHECK_DST_SIZE
+#define CHECK_DST_SIZE() \
+  if (cur-dst >= dstsize) { \
+    TRACE("RLC decoding size too big"); \
+    return 0; \
+  }
+
+unsigned int uncompress(uint8_t * dst, unsigned int dstsize, const uint8_t * src, unsigned int srcsize)
 {
   uint8_t * cur = dst;
   uint8_t zeroes = 0;
@@ -70,22 +89,26 @@ unsigned int uncompress(uint8_t * dst, const uint8_t * src, unsigned int len)
   for( ; 1; ) {
     if (zeroes > 0) {
       for (int i = 0; i < zeroes; i++) {
+        CHECK_DST_SIZE();
         *cur++ = 0;
       }
       zeroes = 0;
     }
 
-    if (len == 0)
-      return cur-dst;
+    if (srcsize == 0) {
+      return cur - dst;
+    }
 
     for (int i=0; i<bRlc; i++) {
+      CHECK_DST_SIZE();
       *cur++ = *src++;
-      if (--len == 0)
-        return cur-dst;
+      if (--srcsize == 0) {
+        return cur - dst;
+      }
     }
 
     bRlc = *src++;
-    --len;
+    --srcsize;
 
     if (!(bRlc & 0x7f)) {
       TRACE("RLC decoding error");
@@ -102,3 +125,5 @@ unsigned int uncompress(uint8_t * dst, const uint8_t * src, unsigned int len)
     }
   }
 }
+
+#undef CHECK_DST_SIZE
\ No newline at end of file
diff --git a/radio/src/storage/storage.h b/radio/src/storage/storage.h
index eea938049..a6edc533f 100644
--- a/radio/src/storage/storage.h
+++ b/radio/src/storage/storage.h
@@ -67,8 +67,8 @@ void postModelLoad(bool newModel);
 #if defined(RAMBACKUP)
 void rambackupWrite();
 bool rambackupRestore();
-unsigned int compress(uint8_t * dst, const uint8_t * src, unsigned int len);
-unsigned int uncompress(uint8_t * dst, const uint8_t * src, unsigned int len);
+unsigned int compress(uint8_t * dst, unsigned int dstsize, const uint8_t * src, unsigned int len);
+unsigned int uncompress(uint8_t * dst, unsigned int dstsize, const uint8_t * src, unsigned int len);
 #endif
 
 #endif // _STORAGE_H_