Skip to content

SBN_ProcessSubsFromPeer: cap SubCnt at SBN_MAX_SUBS_PER_PEER #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nurdymuny wants to merge 2 commits into
base: dev
Choose a base branch
from
Open

SBN_ProcessSubsFromPeer: cap SubCnt at SBN_MAX_SUBS_PER_PEER #93

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4f17ec1
SBN_ProcessSubsFromPeer: cap SubCnt at SBN_MAX_SUBS_PER_PEER
nurdymuny Jun 9, 2026
fb4e2bb
SBN_ProcessUnsubsFromPeer: apply same SubCnt cap as ProcessSubsFromPeer
nurdymuny Jun 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions fsw/src/sbn_subs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -503,6 +503,21 @@ SBN_Status_t SBN_ProcessSubsFromPeer(SBN_PeerInterface_t *Peer, void *Msg)
uint16 SubCnt;
Unpack_UInt16(&Pack, &SubCnt);

/* Reject up front if the peer-supplied SubCnt exceeds the per-peer
subscription cap. Without this we walk the loop SubCnt times
(up to 65535) doing Unpack_Data + ProcessSubFromPeer; ProcessSub
returns SBN_ERROR once the cap is hit, but on the way we waste
CPU + log churn. Bound the loop at SBN_MAX_SUBS_PER_PEER so a
single malformed subscription message can't pin a CPU. */
if (SubCnt > SBN_MAX_SUBS_PER_PEER)
{
EVSSendErr(SBN_PROTO_EID,
"peer CpuID %d sent SubCnt=%u, exceeds SBN_MAX_SUBS_PER_PEER=%u",
Peer->ProcessorID, (unsigned)SubCnt,
(unsigned)SBN_MAX_SUBS_PER_PEER);
return SBN_ERROR;
}

int SubIdx = 0;
for (SubIdx = 0; SubIdx < SubCnt; SubIdx++)
{
Expand Down Expand Up @@ -618,6 +633,20 @@ SBN_Status_t SBN_ProcessUnsubsFromPeer(SBN_PeerInterface_t *Peer, void *Msg)
uint16 SubCnt;
Unpack_UInt16(&Pack, &SubCnt);

/* Same cap as in SBN_ProcessSubsFromPeer — a peer can send SubCnt up
to 65535 and the loop will dispatch that many unsubscribe requests
per packet, with no per-iteration error short-circuit (the comment
below explicitly ignores the return value to "unsub as much as I
can"). Cap here so a single malformed packet can't tie up a CPU. */
if (SubCnt > SBN_MAX_SUBS_PER_PEER)
{
EVSSendErr(SBN_PROTO_EID,
"peer CpuID %d sent SubCnt=%u in Unsubs message, exceeds SBN_MAX_SUBS_PER_PEER=%u",
Peer->ProcessorID, (unsigned)SubCnt,
(unsigned)SBN_MAX_SUBS_PER_PEER);
return SBN_ERROR;
}

int SubIdx = 0;
for (SubIdx = 0; SubIdx < SubCnt; SubIdx++)
{
Expand Down