UART Demo Projects

[adam-3bian]

No description provided.

[rmn30]

I'm not so familiar with AT command processing but is it standard to just ignore characters in a command after 32 bytes?

[rmn30]

I think there's a second (intentional) overflow here if there is a BufferSize length or greater command followed by \n or \r?

[adam-3bian]

For the purposes of a demo, I've limited to 32-bytes. It allowed me to send a sensible input of 33 or above to see if at_state_process_input would stop the overrun.

For example, if you send:

AT=ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\r\n

The current code should read both \r and \n as new line characters. This isn't standard behaviour. Probably only \r should be used and \n should be ignored if found afterwards.

[rmn30]

I think the at_command_set handler assumes this is null terminated so I think I could trigger a crash if it isn't? Potentially a nice demo to have a compartment_error_handler that handles this.

[rmn30]

Also argument is out of bounds if there is a BufferSize command that ends in =.

[rmn30]

This field is unused.

[rmn30]

In case you are wondering why you're not getting traps in your example it may be because we have not turned on sub-object bounds by default so all the overflows of ATState.buffer are actually in the same object. You might want to add -Xclang -cheri-bounds=subobject-safe when compiling. Note that the overflows would still be difficult to exploit except as DoS due to not being able to forge pointers on CHERI.

More info: https://www.cl.cam.ac.uk/~pffm2/sosp2023_cheri_tutorial/exercises/4_subobject-bounds/README.html

[rmn30]

Also re. code style since this is C++ all the functions that take an ATState * should be methods (or constructors) of ATState!

[adam-3bian]

Some code I've previously kept as C compatible to allow for easy binding to other languages. This was probably OK for a proof of concept, but not for the final solution.

[adam-3bian]

I need to run another pass over this, hopefully the code takes on board your C/C++ comments. Uses only carriage return now. I still need to implement compartment_error_handler. Ideally the AT commands should be case insensitive.

[adam-3bian]

Stack sizes to be lowered in next commit.