From 457748f6faba8088d0917a0358f0752652e04feb Mon Sep 17 00:00:00 2001 From: wyf-777 Date: Mon, 7 Sep 2026 12:06:56 +0800 Subject: [PATCH] [net][at] Reject overlong numeric hostnames Numeric hostnames were copied into a fixed stack buffer without a length bound. Cache the length, reject values that cannot fit, and terminate the copy explicitly. Fixes #11332 Assisted-by: OpenAI Codex:GPT-5 --- components/net/at/at_socket/at_socket.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/components/net/at/at_socket/at_socket.c b/components/net/at/at_socket/at_socket.c index 58680e2b3454..495f43e8184b 100644 --- a/components/net/at/at_socket/at_socket.c +++ b/components/net/at/at_socket/at_socket.c @@ -1409,6 +1409,7 @@ static int _gethostbyname_by_device(const char *name, ip_addr_t *addr) struct at_device *device = RT_NULL; char ipstr[16] = { 0 }; size_t idx = 0; + size_t name_len = 0; device = at_device_get_first_initialized(); if (device == RT_NULL) @@ -1421,9 +1422,10 @@ static int _gethostbyname_by_device(const char *name, ip_addr_t *addr) return -1; } - for (idx = 0; idx < strlen(name) && !isalpha(name[idx]); idx++); + name_len = strlen(name); + for (idx = 0; idx < name_len && !isalpha((unsigned char)name[idx]); idx++); - if (idx < strlen(name)) + if (idx < name_len) { if (at_dlock == RT_NULL) { @@ -1444,7 +1446,13 @@ static int _gethostbyname_by_device(const char *name, ip_addr_t *addr) } else { - strncpy(ipstr, name, strlen(name)); + if (name_len >= sizeof(ipstr)) + { + return -1; + } + + rt_memcpy(ipstr, name, name_len); + ipstr[name_len] = '\0'; } #if NETDEV_IPV4 && NETDEV_IPV6