FHSS: validate received synch info.

source/Service_Libs/fhss/fhss.c

@@ -347,7 +347,7 @@ static int fhss_sync_with_beacon(fhss_structure_t *fhss_structure,
 
  if (fhss_structure) {
  // Do not allow synchronising devices above 253 hops.
- if (payload->hop_count > 253) {
+ if (payload->hop_count > (FHSS_MAX_ALLOWED_HOPS-1)) {
  return 0;
  }
  // To make synchronization monitoring more effective, drop extra Beacons.
@@ -868,6 +868,35 @@ static void fhss_beacon_decode(fhss_synchronization_beacon_payload_s* dest, cons
  }
 }
 
+static int fhss_synch_info_validate(fhss_synchronization_beacon_payload_s *payload)
+{
+ if (!payload) {
+ return -1;
+ }
+ if (payload->data_start_delimeter != 0) {
+ return -1;
+ }
+ if (payload->current_superframe >= payload->number_of_superframes_per_channel) {
+ return -1;
+ }
+ if (payload->remaining_slots >= payload->superframe_length) {
+ return -1;
+ }
+ if (payload->hop_count > FHSS_MAX_ALLOWED_HOPS-1) {
+ return -1;
+ }
+ if (payload->number_of_broadcast_channels == 0) {
+ return -1;
+ }
+ if (payload->number_of_tx_slots == 0) {
+ return -1;
+ }
+ if (payload->number_of_superframes_per_channel == 0) {
+ return -1;
+ }
+ return 0;
+}
+
 static void fhss_beacon_received(fhss_structure_t *fhss_structure, const uint8_t *synch_info, const uint32_t elapsed_time)
 {
 
@@ -877,9 +906,11 @@ static void fhss_beacon_received(fhss_structure_t *fhss_structure, const uint8_t
  fhss_synchronization_beacon_payload_s temp_payload;
  temp_payload.processing_delay = fhss_structure->bs->fhss_configuration.fhss_tuning_parameters.rx_processing_delay;
  fhss_beacon_decode(&temp_payload, synch_info, elapsed_time, fhss_structure->number_of_channels);
-
- // use the received information
- fhss_sync_with_beacon(fhss_structure, &temp_payload);
+ if (!fhss_synch_info_validate(&temp_payload)) {
+ fhss_sync_with_beacon(fhss_structure, &temp_payload);
+ } else {
+ tr_err("Invalid synch info received");
+ }
  }
  }
 }

source/Service_Libs/fhss/fhss.h

@@ -23,6 +23,7 @@
 #define MAX_SYNCH_INFOS_PER_CHANNEL_LIST 2
 // FHSS randomly selects the starting superframe for broadcast channel. This defines how many superframes are used for randomization.
 #define NUMBER_OF_BC_START_SUPERFRAMES 3
+#define FHSS_MAX_ALLOWED_HOPS 254
 #define MAX_FHSS_TIMER_DIVIDER 100
 #define SYNCH_MONITOR_AVG_SAMPLES 5
 #define FHSS_DATA_START_DELIMETER 0x00