ninharp/ninlight-w600
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(sacn): validate universe/start_slot via get_int(), reject fractional input

Browse Source
This commit is contained in:
Michael Sauer
2026-09-20 00:29:47 +02:00
parent e892b441ce
commit 545ca30699
2 changed files with 26 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/net/nl_api.c
+10 -10
View File
@@ -352,18 +352,18 @@ static void handle_put_settings(const nl_api_ctx_t *ctx, const nl_http_request_t
s.auth_all = cJSON_IsTrue(all) ? 1 : 0;
} else if (strcmp(type, "sacn") == 0) {
const cJSON *en = cJSON_GetObjectItemCaseSensitive(j, "enabled");
const cJSON *un = cJSON_GetObjectItemCaseSensitive(j, "universe");
const cJSON *st = cJSON_GetObjectItemCaseSensitive(j, "start_slot");
const char *ot = NULL;
int otp;
long un = 0, st = 0;
int unp, stp, otp;
uint8_t slots = nl_board_dmx_slots(ctx->board);
if (en && !cJSON_IsBool(en)) {
err = "invalid enabled";
} else if (un && (!cJSON_IsNumber(un) || un->valuedouble < 1 || un->valuedouble > 63999)) {
} else if ((unp = get_int(j, "universe", 1, 63999, &un)) < 0) {
err = "invalid universe";
} else if (st && (!cJSON_IsNumber(st) || st->valuedouble < 1 ||
st->valuedouble + slots - 1 > 512)) {
/* Upper bound folds the board's slot count in: the highest start_slot that still
* leaves room for all of them is 512 - slots + 1. */
} else if ((stp = get_int(j, "start_slot", 1, 512 - slots + 1, &st)) < 0) {
err = "invalid start_slot";
} else if ((otp = get_string(j, "on_timeout", 1, 16, &ot)) < 0 ||
(otp == 1 && strcmp(ot, "release") != 0 && strcmp(ot, "hold") != 0)) {
@@ -371,10 +371,10 @@ static void handle_put_settings(const nl_api_ctx_t *ctx, const nl_http_request_t
} else {
if (en)
s.sacn_enabled = cJSON_IsTrue(en) ? 1 : 0;
if (un)
s.sacn_universe = (uint16_t)un->valuedouble;
if (st)
s.sacn_start_slot = (uint16_t)st->valuedouble;
if (unp == 1)
s.sacn_universe = (uint16_t)un;
if (stp == 1)
s.sacn_start_slot = (uint16_t)st;
if (otp == 1)
s.sacn_hold = strcmp(ot, "hold") == 0 ? 1 : 0;
}