Skip to content

LoRa Security Fix#105

Merged
266-750Balloons merged 2 commits into
development/LoRafrom
feature/NR/lora-security-fix
Mar 25, 2026
Merged

LoRa Security Fix#105
266-750Balloons merged 2 commits into
development/LoRafrom
feature/NR/lora-security-fix

Conversation

@Bigmouseears

Copy link
Copy Markdown
Contributor

…er size

Description

A brief description of the changes in the PR

Issue Link

Please provide a link to the issue (e.g. "Closes #1").

Also, if this PR is one of multiple for this issue, link the parent if this is a child OR link
the children if this is the parent. Do not use "closes" keywords on child PRs, only use them on
the parent.

Testing

  • Passes existing unit tests
  • Unit tests modified (link the test changes as a child PR)
  • Integration test performed

Attach any test artifacts here, if relevant.

Other

Leave any additional notes here

Reviewer Checklist

Standards

  • Follows FCF Architectural Standards
  • Follows SDR Coding Standards
  • Code complexity/function Size is minimized
  • Code is testable
  • Code is readable and commented properly
  • License terms are respected

Error Handling

  • Potentially unsafe functions return a status code
  • Error returns properly handled

Memory

  • Stack allocated memory is scoped correctly
  • Heap allocated memory is avoided
  • Globally allocated memory is minimized except when necessary
  • Pointers are used correctly
  • Concurrency has been considered

Performance

  • Rate limiters are respected
  • Busy waiting is avoided
  • "Delay" calls are not used in performance sensitive code

@ETSells ETSells left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! @266-750Balloons should approve as well since it's his component.

Comment thread lora/lora.c Outdated


if (*buffer_len_ptr > *max_buffer_len) {
return LORA_FAIL;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: consider adding a new status entry for this particular status (something like LORA_BUFFER_UNDERSIZED). This would allow us to detect when this condition occurs in the app/mod layer, and thus we could implement fail-safe handling for this condition.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oop I think I did add that, I just forgot to commit it. LORA_BUFFER_UNDERSIZED sounds like a better name than what I had originally though

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah this looks great to me. Up to @266-750Balloons now.

@ETSells

ETSells commented Mar 17, 2026

Copy link
Copy Markdown
Member

@266-750Balloons Stale PR: bump.

@266-750Balloons 266-750Balloons left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Merging. Sorry for taking 50 years to review this.

@266-750Balloons 266-750Balloons merged commit 3b61cfe into development/LoRa Mar 25, 2026
2 checks passed
@ETSells ETSells deleted the feature/NR/lora-security-fix branch April 29, 2026 08:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

LoRa: Exploitable buffer overflow vulnerability in working version of lora_receive

3 participants