From 9c0f62bc0cde7aaeee3abb917d0c8f63636e40d4 Mon Sep 17 00:00:00 2001 From: chao an Date: Thu, 22 Oct 2026 22:47:51 +0800 Subject: [PATCH 1/2] netutils/xmlrpc: Bound parsed XML-RPC parameters xmlrpc_parseparam() used g_xmlcall.argsize to index the fixed-size XML-RPC parameter arrays without checking it against MAX_ARGS. A request with too many parameters could write past g_xmlcall.args[] and g_xmlcall.arguments[]. Reject additional parameters once MAX_ARGS is reached, propagate parse errors while parsing the parameter list, and make xmlrpc_parse() honor xmlrpc_parsemethod() failures before dispatching the registered method. Signed-off-by: chao an --- netutils/xmlrpc/xmlparser.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/netutils/xmlrpc/xmlparser.c b/netutils/xmlrpc/xmlparser.c index 4c0203a67ac..f39e4b3f2d6 100644 --- a/netutils/xmlrpc/xmlparser.c +++ b/netutils/xmlrpc/xmlparser.c @@ -177,6 +177,11 @@ static int xmlrpc_parseparam(struct parsebuf_s *pbuf) { int type; + if (g_xmlcall.argsize >= MAX_ARGS) + { + return XMLRPC_PARSE_ERROR; + } + /* Next, we need a tag */ type = xmlrpc_getelement(pbuf, g_data, CONFIG_XMLRPC_STRINGSIZE); @@ -293,6 +298,10 @@ static int xmlrpc_parseparams(struct parsebuf_s *pbuf) if ((type == TAG) && (!strncmp(g_data, "", 7))) { ret = xmlrpc_parseparam(pbuf); + if (ret < 0) + { + return ret; + } } else if ((type == TAG) && (!strncmp(g_data, "", 9))) { @@ -380,16 +389,23 @@ int xmlrpc_parse(int sock, char *buffer) { /* Parse the remaining tags within the methodCall tag */ - xmlrpc_parsemethod(&pbuf); - - /* Check for the closing /methodCall */ - - type = xmlrpc_getelement(&pbuf, g_data, CONFIG_XMLRPC_STRINGSIZE); - if ((type == TAG) && (!strncmp(g_data, "", 13))) + ret = xmlrpc_parsemethod(&pbuf); + if (ret == XMLRPC_NO_ERROR) { - /* Successful parse, try to call a user function */ - - ret = xmlrpc_call(&g_xmlcall); + /* Check for the closing /methodCall */ + + type = xmlrpc_getelement(&pbuf, g_data, + CONFIG_XMLRPC_STRINGSIZE); + if ((type == TAG) && (!strncmp(g_data, "", 13))) + { + /* Successful parse, try to call a user function */ + + ret = xmlrpc_call(&g_xmlcall); + } + else + { + ret = XMLRPC_PARSE_ERROR; + } } } } From 142ab8a13966448167d48ccdddbeaf35f8a4c7e0 Mon Sep 17 00:00:00 2001 From: archer Date: Fri, 23 Oct 2026 22:24:17 +0800 Subject: [PATCH 2/2] netutils/xmlrpc: Fix nxstyle alignment errors in xmlparser.c Fix nxstyle "Bad alignment" errors in the switch-case block of xmlrpc_parseparam(). Align case labels and body statements to conform with the NuttX coding standard. Signed-off-by: chao an --- netutils/xmlrpc/xmlparser.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/netutils/xmlrpc/xmlparser.c b/netutils/xmlrpc/xmlparser.c index f39e4b3f2d6..ca4d6de6812 100644 --- a/netutils/xmlrpc/xmlparser.c +++ b/netutils/xmlrpc/xmlparser.c @@ -233,22 +233,22 @@ static int xmlrpc_parseparam(struct parsebuf_s *pbuf) switch (g_xmlcall.args[g_xmlcall.argsize]) { - case 'i': - case 'b': - g_xmlcall.arguments[g_xmlcall.argsize].u.i = atoi(g_data); - break; - - case 'd': - g_xmlcall.arguments[g_xmlcall.argsize].u.d = atof(g_data); - break; - - case 's': - strlcpy(g_xmlcall.arguments[g_xmlcall.argsize].u.string, g_data, - sizeof(g_xmlcall.arguments[g_xmlcall.argsize].u.string)); - break; - - default: - return XMLRPC_PARSE_ERROR; + case 'i': + case 'b': + g_xmlcall.arguments[g_xmlcall.argsize].u.i = atoi(g_data); + break; + + case 'd': + g_xmlcall.arguments[g_xmlcall.argsize].u.d = atof(g_data); + break; + + case 's': + strlcpy(g_xmlcall.arguments[g_xmlcall.argsize].u.string, g_data, + sizeof(g_xmlcall.arguments[g_xmlcall.argsize].u.string)); + break; + + default: + return XMLRPC_PARSE_ERROR; } g_xmlcall.argsize++;