This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-mcumgr.git
commit 18aeb14413fab6050166802d290550524d357dc4 Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 15:56:36 2026 +0200 cborattr: Fix string array decoding When string array element did not fit in remaining store space, pointer to store was still advanced by full string length and remaining space calculation for next element was wrong. Store pointer is now advanced only after successful copy, space for terminating NUL is reserved and decoding is stopped on first error. Assisted-by: Claude:claude-opus-5-5 --- cborattr/src/cborattr.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/cborattr/src/cborattr.c b/cborattr/src/cborattr.c index 3c4c49e..797d96a 100644 --- a/cborattr/src/cborattr.c +++ b/cborattr/src/cborattr.c @@ -443,7 +443,17 @@ cbor_read_array(struct CborValue *value, const struct cbor_array_t *arr) #endif case CborAttrTextStringType: len = arr->arr.strings.storelen - (tp - arr->arr.strings.store); + if (len < 1) { + err |= CborErrorOutOfMemory; + break; + } + /* Reserve space for terminating NUL */ + len--; err |= cbor_value_copy_text_string(&elem, tp, &len, NULL); + if (err) { + break; + } + tp[len] = '\0'; arr->arr.strings.ptrs[off] = tp; tp += len + 1; break; @@ -455,6 +465,9 @@ cbor_read_array(struct CborValue *value, const struct cbor_array_t *arr) err |= CborErrorIllegalType; break; } + if (err) { + break; + } arrcount++; if (arr->element_type != CborAttrStructObjectType) { adv_err = cborattr_advance(&elem);
