cbor: improve error handling

Author: bkleiner

src/driver/dma.c

@@ -1,5 +1,7 @@
 #include "dma.h"
 
+#include <string.h>
+
 #include "core/project.h"
 #include "util/cbor_helper.h"
 #include "util/util.h"
@@ -75,6 +77,9 @@ cbor_result_t cbor_encode_dma_stream_t(cbor_value_t *enc, const dma_stream_t *d)
 cbor_result_t cbor_decode_target_dma_array(cbor_value_t *dec, target_dma_t (*dma)[DMA_DEVICE_MAX]) {
   cbor_result_t res = CBOR_OK;
 
+  memset(dma, 0, DMA_DEVICE_MAX * sizeof(target_dma_t));
+  memset(dma_stream_map, 0, DMA_STREAM_MAX * sizeof(dma_device_t));
+
   cbor_container_t map;
   CBOR_CHECK_ERROR(res = cbor_decode_map(dec, &map));
   for (uint32_t i = 0; i < cbor_decode_map_size(dec, &map); i++) {

src/util/cbor_helper.h

@@ -124,6 +124,9 @@ cbor_result_t cbor_handle_error(cbor_result_t err);
     for (uint32_t i = 0; i < min(size, cbor_decode_array_size(dec, &array)); i++) { \
       type tmp = {};                                                                \
       CBOR_CHECK_ERROR(res = cbor_decode_##type(dec, &tmp));                        \
+      if (tmp.index >= size) {                                                      \
+        CBOR_CHECK_ERROR(res = CBOR_ERR_OVERFLOW);                                  \
+      }                                                                             \
       o->member[tmp.index] = tmp;                                                   \
     }                                                                               \
     continue;                                                                       \