From fcc9598f4e040371bc57b025862037f585592028 Mon Sep 17 00:00:00 2001 From: Kody Stribrny Date: Mon, 20 Apr 2026 13:28:36 -0700 Subject: [PATCH 1/4] Limit the number of returned access technology settings Respect the maximum list size of eRDX configurations --- source/cellular_3gpp_api.c | 7 +++- test/unit-test/cellular_3gpp_api_utest.c | 46 ++++++++++++++++++++++++ 2 files changed, 52 insertions(+), 1 deletion(-) diff --git a/source/cellular_3gpp_api.c b/source/cellular_3gpp_api.c index a1de7399..0a69fce9 100644 --- a/source/cellular_3gpp_api.c +++ b/source/cellular_3gpp_api.c @@ -1390,7 +1390,7 @@ static CellularPktStatus_t _Cellular_RecvFuncGetEidrxSettings( CellularContext_t { LogDebug( ( "GetEidrx: empty EDRXS setting %s", pInputLine ) ); } - else + else if( count < CELLULAR_EDRX_LIST_MAX_SIZE ) { atCoreStatus = parseEidrxLine( pInputLine, count, pEidrxSettingsList ); pktStatus = _Cellular_TranslateAtCoreStatus( atCoreStatus ); @@ -1400,6 +1400,11 @@ static CellularPktStatus_t _Cellular_RecvFuncGetEidrxSettings( CellularContext_t count++; } } + else + { + LogError( ( "GetEidrx: eidrxList is full, CELLULAR_EDRX_LIST_MAX_SIZE=%u", CELLULAR_EDRX_LIST_MAX_SIZE ) ); + pktStatus = CELLULAR_PKT_STATUS_SIZE_MISMATCH; + } pCommnadItem = pCommnadItem->pNext; pEidrxSettingsList->count = count; diff --git a/test/unit-test/cellular_3gpp_api_utest.c b/test/unit-test/cellular_3gpp_api_utest.c index 136a342f..9e241a92 100644 --- a/test/unit-test/cellular_3gpp_api_utest.c +++ b/test/unit-test/cellular_3gpp_api_utest.c @@ -732,6 +732,22 @@ CellularPktStatus_t Mock_AtcmdRequestWithCallback__Cellular_Cellular_RecvFuncGet _saveData( pLine2, &atResp, sizeof( pLine2 ) ); pktStatus = atReq.respCallback( pContext, &atResp, &cellularEidrxSettingsList, sizeof( CELLULAR_EDRX_LIST_MAX_SIZE ) ); } + else if( cbCondition == 5 ) + { + /* Create CELLULAR_EDRX_LIST_MAX_SIZE + 1 parseable lines to exercise the + * bounds check. The callback must cap count at CELLULAR_EDRX_LIST_MAX_SIZE + * and not write past the end of the eidrxList array. */ + char pLines[ CELLULAR_EDRX_LIST_MAX_SIZE + 1 ][ sizeof( CELLULAR_SAMPLE_PREFIX_STRING_INPUT ) ]; + uint8_t i; + + for( i = 0; i < CELLULAR_EDRX_LIST_MAX_SIZE + 1; i++ ) + { + memcpy( pLines[ i ], CELLULAR_SAMPLE_PREFIX_STRING_INPUT, sizeof( CELLULAR_SAMPLE_PREFIX_STRING_INPUT ) ); + _saveData( pLines[ i ], &atResp, sizeof( pLines[ i ] ) ); + } + + pktStatus = atReq.respCallback( pContext, &atResp, &cellularEidrxSettingsList, CELLULAR_EDRX_LIST_MAX_SIZE ); + } return pktStatus; } @@ -1844,6 +1860,36 @@ void test_Cellular_CommonGetEidrxSettings_Cb_Cellular_RecvFuncGetEidrxSettings_H TEST_ASSERT_EQUAL( CELLULAR_SUCCESS, cellularStatus ); } +/** + * @brief Test that _Cellular_RecvFuncGetEidrxSettings returns an error and does + * not write past eidrxList when the modem returns more than + * CELLULAR_EDRX_LIST_MAX_SIZE +CEDRXS lines. + */ +void test_Cellular_CommonGetEidrxSettings_Cb_Cellular_RecvFuncGetEidrxSettings_Overflow_Capped( void ) +{ + CellularError_t cellularStatus = CELLULAR_SUCCESS; + CellularContext_t context; + + memset( &context, 0, sizeof( CellularContext_t ) ); + CellularHandle_t cellularHandle = &context; + CellularEidrxSettingsList_t eidrxSettingsList; + + memset( &eidrxSettingsList, 0, sizeof( CellularEidrxSettingsList_t ) ); + + _Cellular_CheckLibraryStatus_IgnoreAndReturn( CELLULAR_SUCCESS ); + _Cellular_IsValidPdn_IgnoreAndReturn( CELLULAR_SUCCESS ); + cbCondition = 5; + _Cellular_AtcmdRequestWithCallback_StubWithCallback( Mock_AtcmdRequestWithCallback__Cellular_Cellular_RecvFuncGetEidrxSettings ); + Cellular_ATRemovePrefix_IgnoreAndReturn( CELLULAR_AT_SUCCESS ); + Cellular_ATRemoveAllDoubleQuote_IgnoreAndReturn( CELLULAR_AT_SUCCESS ); + Cellular_ATGetNextTok_StubWithCallback( Mock_Cellular_ATGetNextTok_Calback ); + Cellular_ATStrtoi_IgnoreAndReturn( CELLULAR_AT_SUCCESS ); + _Cellular_TranslateAtCoreStatus_IgnoreAndReturn( CELLULAR_PKT_STATUS_OK ); + _Cellular_TranslatePktStatus_ExpectAndReturn( CELLULAR_PKT_STATUS_SIZE_MISMATCH, CELLULAR_INTERNAL_FAILURE ); + cellularStatus = Cellular_CommonGetEidrxSettings( cellularHandle, &eidrxSettingsList ); + TEST_ASSERT_EQUAL( CELLULAR_INTERNAL_FAILURE, cellularStatus ); +} + /** * @brief Test that happy path case Cellular_CommonGetEidrxSettings to return CELLULAR_SUCCESS. */ From 46a5fad954fdc0c1461012675c917245d376b5de Mon Sep 17 00:00:00 2001 From: Kody Stribrny Date: Fri, 26 Jun 2026 11:16:24 -0700 Subject: [PATCH 2/4] Fixing memory statistics --- docs/doxygen/include/size_table.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/doxygen/include/size_table.md b/docs/doxygen/include/size_table.md index 634fbd66..93acf05f 100644 --- a/docs/doxygen/include/size_table.md +++ b/docs/doxygen/include/size_table.md @@ -9,7 +9,7 @@ cellular_3gpp_api.c -
6.4K
+
6.5K
5.9K
@@ -44,7 +44,7 @@ Total estimates -
15.3K
 +
15.4K
13.9K
 From 53a96f32a07ec710c7945c385622129c89ac691b Mon Sep 17 00:00:00 2001 From: Kody Stribrny Date: Thu, 2 Jul 2026 13:09:02 -0700 Subject: [PATCH 3/4] Add assertion for parseEidrxLine function This should never be called with more than the maximum configured count. Assert if it somehow is --- source/cellular_3gpp_api.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/source/cellular_3gpp_api.c b/source/cellular_3gpp_api.c index 0a69fce9..4c533eff 100644 --- a/source/cellular_3gpp_api.c +++ b/source/cellular_3gpp_api.c @@ -1300,6 +1300,8 @@ static CellularATError_t parseEidrxLine( char * pInputLine, char * pLocalInputLine = pInputLine; CellularATError_t atCoreStatus = CELLULAR_AT_SUCCESS; uint8_t tokenIndex = 0; + + CELLULAR_CONFIG_ASSERT( count < CELLULAR_EDRX_LIST_MAX_SIZE ); atCoreStatus = Cellular_ATRemovePrefix( &pLocalInputLine ); From bf0e2f22a4b76e3b38b98229a4e4f534c28934b7 Mon Sep 17 00:00:00 2001 From: Kody Stribrny Date: Thu, 2 Jul 2026 13:10:50 -0700 Subject: [PATCH 4/4] Formatting --- source/cellular_3gpp_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/cellular_3gpp_api.c b/source/cellular_3gpp_api.c index 4c533eff..0ef07a5d 100644 --- a/source/cellular_3gpp_api.c +++ b/source/cellular_3gpp_api.c @@ -1300,7 +1300,7 @@ static CellularATError_t parseEidrxLine( char * pInputLine, char * pLocalInputLine = pInputLine; CellularATError_t atCoreStatus = CELLULAR_AT_SUCCESS; uint8_t tokenIndex = 0; - + CELLULAR_CONFIG_ASSERT( count < CELLULAR_EDRX_LIST_MAX_SIZE ); atCoreStatus = Cellular_ATRemovePrefix( &pLocalInputLine );