This thread has been locked.
If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.
Hello,
the PSIRT Notification mentions the following:
It states that this is valid for the SDK versions v6.10.00.05 and earlier.
The function HTTPClient_setHeaderByName is located in the source file source\ti\net\http\httpclient.c.
At least in the SDK versions 5_30_00_08, 6_10_00_05 and 7_10_00_13.this file is not changed..
The function StrMpl_getAllocStr is located in the file source\ti\net\utils\str_mpl.c.
That file is also not changed between the mentioned SDK version.
Is the mentioned overflow not fixed in the source file containing the function code?
Where are the two overflow fixed?
Where can I get detailed information about that overflows to evaluate if I need to switch the used SDK version?
Many thanks in advance,
Roman Jordan
You are right - the fix was not included to 7.10 !!!
I'm adding the fixed httpclient.c here. Just replace the code in SDK7.10 (and rebuild the httpclient lib).
We will try to add another release with this and other fixes, but for now please use the patch.
I'm also checking regarding the fix in StrMpl_getAllocStr, but the relevant owner is out this week.
I guess similar fix should exist there. I'll update when we find anything.
there doesn't seem to be a real issue in StrMpl_getAllocStr so no fix is needed there.