This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
commit ba7f314928fe5514f79c28ad172382db039d66e2 Author: chao an <[email protected]> AuthorDate: Thu Oct 22 22:47:51 2026 +0800 netutils/xmlrpc: Bound parsed XML-RPC parameters xmlrpc_parseparam() used g_xmlcall.argsize to index the fixed-size XML-RPC parameter arrays without checking it against MAX_ARGS. A request with too many parameters could write past g_xmlcall.args[] and g_xmlcall.arguments[]. Reject additional parameters once MAX_ARGS is reached, propagate parse errors while parsing the parameter list, and make xmlrpc_parse() honor xmlrpc_parsemethod() failures before dispatching the registered method. Signed-off-by: chao an <[email protected]> --- netutils/xmlrpc/xmlparser.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/netutils/xmlrpc/xmlparser.c b/netutils/xmlrpc/xmlparser.c index 4c0203a67..f39e4b3f2 100644 --- a/netutils/xmlrpc/xmlparser.c +++ b/netutils/xmlrpc/xmlparser.c @@ -177,6 +177,11 @@ static int xmlrpc_parseparam(struct parsebuf_s *pbuf) { int type; + if (g_xmlcall.argsize >= MAX_ARGS) + { + return XMLRPC_PARSE_ERROR; + } + /* Next, we need a <value> tag */ type = xmlrpc_getelement(pbuf, g_data, CONFIG_XMLRPC_STRINGSIZE); @@ -293,6 +298,10 @@ static int xmlrpc_parseparams(struct parsebuf_s *pbuf) if ((type == TAG) && (!strncmp(g_data, "<param>", 7))) { ret = xmlrpc_parseparam(pbuf); + if (ret < 0) + { + return ret; + } } else if ((type == TAG) && (!strncmp(g_data, "</params>", 9))) { @@ -380,16 +389,23 @@ int xmlrpc_parse(int sock, char *buffer) { /* Parse the remaining tags within the methodCall tag */ - xmlrpc_parsemethod(&pbuf); - - /* Check for the closing /methodCall */ - - type = xmlrpc_getelement(&pbuf, g_data, CONFIG_XMLRPC_STRINGSIZE); - if ((type == TAG) && (!strncmp(g_data, "</methodCall>", 13))) + ret = xmlrpc_parsemethod(&pbuf); + if (ret == XMLRPC_NO_ERROR) { - /* Successful parse, try to call a user function */ - - ret = xmlrpc_call(&g_xmlcall); + /* Check for the closing /methodCall */ + + type = xmlrpc_getelement(&pbuf, g_data, + CONFIG_XMLRPC_STRINGSIZE); + if ((type == TAG) && (!strncmp(g_data, "</methodCall>", 13))) + { + /* Successful parse, try to call a user function */ + + ret = xmlrpc_call(&g_xmlcall); + } + else + { + ret = XMLRPC_PARSE_ERROR; + } } } }
