Fix buffer overflows, double-free, and test bugs

Add bounded variants of XOR decode and message extraction functions
that check computed message length against actual buffer size before
reading, preventing stack-buffer-overflows when trying wrong XOR keys.

Fix double-free in phev_pipe_outputChainInputTransformer where both the
transformer and the framework freed the same message on decode failure.
Now frees only the locally-allocated phevMessage and lets the framework
handle the original message lifecycle.

Fix test_phev_pipe_updateRegisterWithCallback_encoded to set commandXOR
alongside currentXOR, matching the corrected XOR key management from
commit 22ac108.

Fix test_phev_service_end_to_end_operations to verify only the last
published message since the test output handler overwrites on each call.

Fix test_core_phev_core_extractIncomingMessageValidFirstByteCommand to
assert raw XOR-encoded bytes and correct XOR key value.

Migrate all test callers of extractIncomingMessageAndXOR and
extractAndDecodeIncomingMessageAndXOR to bounded variants to eliminate
ASAN-detected stack overflows with small test buffers.

Author: papawattu

include/phev_core.h

@@ -149,10 +149,14 @@ bool phev_core_validateChecksum(const uint8_t *data);
 
 message_t * phev_core_extractIncomingMessageAndXOR(const uint8_t * data);
 
+message_t * phev_core_extractIncomingMessageAndXORBounded(const uint8_t * data, const size_t bufLen);
+
 message_t * phev_core_extractOutgoingMessageAndXOR(const uint8_t * data);
 
 message_t * phev_core_extractAndDecodeIncomingMessageAndXOR(const uint8_t *data);
 
+message_t * phev_core_extractAndDecodeIncomingMessageAndXORBounded(const uint8_t *data, const size_t bufLen);
+
 message_t * phev_core_extractAndDecodeOutgoingMessageAndXOR(const uint8_t *data);
 
 message_t * phev_core_createMsgXOR(const uint8_t * data, const size_t length, const uint8_t xor);

src/phev_core.c

@@ -28,6 +28,38 @@ uint8_t *phev_core_xorDataWithValue(const uint8_t *data, const uint8_t xor)
 
     return decoded;
 }
+static uint8_t *phev_core_xorDataWithValueBounded(const uint8_t *data, const uint8_t xor, const size_t bufLen)
+{
+    LOG_V(APP_TAG, "START - xorDataWithValueBounded");
+
+    if (bufLen < 2)
+    {
+        LOG_E(APP_TAG, "Buffer too small for XOR decode");
+        return NULL;
+    }
+
+    size_t length = (data[1] ^ xor) + 2;
+
+    if (length > bufLen)
+    {
+        LOG_D(APP_TAG, "Computed length %zu exceeds buffer size %zu with XOR %02X", length, bufLen, xor);
+        return NULL;
+    }
+
+    uint8_t *decoded = malloc(length);
+
+    LOG_D(APP_TAG, "Decoding data with length %d with XOR %02X", length, xor);
+
+    for (int i = 0; i < length; i++)
+    {
+        decoded[i] = data[i] ^ xor;
+    }
+
+    LOG_BUFFER_HEXDUMP(APP_TAG, decoded, length, LOG_DEBUG);
+    LOG_V(APP_TAG, "END - xorDataWithValueBounded");
+
+    return decoded;
+}
 bool phev_core_checkIncomingCommand(const uint8_t command)
 {
     switch (command)
@@ -103,6 +135,21 @@ bool phev_core_validateChecksumXOR(const uint8_t *data, const uint8_t xor)
 
     return valid;
 }
+static bool phev_core_validateChecksumXORBounded(const uint8_t *data, const uint8_t xor, const size_t bufLen)
+{
+    uint8_t *decodedData = phev_core_xorDataWithValueBounded(data, xor, bufLen);
+
+    if (decodedData == NULL)
+    {
+        return false;
+    }
+
+    bool valid = phev_core_validateChecksum(decodedData);
+
+    free(decodedData);
+
+    return valid;
+}
 message_t *phev_core_unencodedIncomingMessage(const uint8_t *data)
 {
     uint8_t command = data[0];
@@ -212,6 +259,37 @@ message_t *phev_core_encodedIncomingMessage(const uint8_t *data)
 
     return NULL;
 }
+static message_t *phev_core_encodedIncomingMessageBounded(const uint8_t *data, const size_t bufLen)
+{
+    if (bufLen < 3)
+    {
+        LOG_E(APP_TAG, "Buffer too small for encoded message decode");
+        return NULL;
+    }
+
+    uint8_t xor = data[2];
+    uint8_t command = data[0] ^ xor;
+    uint8_t length = (data[1] ^ xor) + 2;
+
+    if (length <= bufLen && phev_core_checkIncomingCommand(command) && phev_core_validateChecksumXORBounded(data, xor, bufLen))
+    {
+        message_t * message = phev_core_createMsgXOR(data,length,xor);
+        return message;
+    }
+
+    xor ^= 1;
+    command = data[0] ^ xor;
+    length = (data[1] ^ xor) + 2;
+
+    if (length <= bufLen && phev_core_checkIncomingCommand(command) && phev_core_validateChecksumXORBounded(data, xor, bufLen))
+    {
+        return phev_core_createMsgXOR(data, length, xor);
+    }
+
+    LOG_E(APP_TAG,"Unknown encoded command %02X or %02X", command, command ^ 1);
+
+    return NULL;
+}
 message_t *phev_core_encodedOutgoingMessage(const uint8_t *data)
 {
     uint8_t xor = data[2];
@@ -256,6 +334,31 @@ message_t * phev_core_extractIncomingMessageAndXOR(const uint8_t *data)
 
     return message;
 }
+message_t * phev_core_extractIncomingMessageAndXORBounded(const uint8_t *data, const size_t bufLen)
+{
+    LOG_V(APP_TAG, "START - extractIncomingMessageAndXORBounded");
+
+    if (bufLen < 3)
+    {
+        LOG_E(APP_TAG, "Buffer too small for message extraction");
+        return NULL;
+    }
+
+    message_t *message = NULL;
+
+    if (phev_core_checkIncomingCommand(data[0]) && phev_core_validateChecksumXORBounded(data, 0, bufLen))
+    {
+        message = phev_core_unencodedIncomingMessage(data);
+    }
+    else
+    {
+        message = phev_core_encodedIncomingMessageBounded(data, bufLen);
+    }
+
+    LOG_V(APP_TAG, "END - extractIncomingMessageAndXORBounded");
+
+    return message;
+}
 message_t * phev_core_extractOutgoingMessageAndXOR(const uint8_t *data)
 {
     LOG_V(APP_TAG, "START - extractOutgoingMessageAndXOR");
@@ -322,6 +425,32 @@ message_t * phev_core_extractAndDecodeIncomingMessageAndXOR(const uint8_t *data)
 
     return decoded;
 }
+message_t * phev_core_extractAndDecodeIncomingMessageAndXORBounded(const uint8_t *data, const size_t bufLen)
+{
+    LOG_V(APP_TAG, "START - extractAndDecodeIncomingMessageAndXORBounded");
+
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(data, bufLen);
+
+    if(message == NULL)
+    {
+        LOG_W(APP_TAG,"Cannot extract incoming message");
+        return NULL;
+    }
+
+    uint8_t xor = phev_core_getMessageXOR(message);
+
+    uint8_t * decodedData = phev_core_xorDataWithValue(message->data, xor);
+
+    message_t * decoded = phev_core_createMsgXOR(decodedData,message->length,xor);
+
+    free(decodedData);
+
+    msg_utils_destroyMsg(message);
+
+    LOG_V(APP_TAG, "END - extractAndDecodeIncomingMessageAndXORBounded");
+
+    return decoded;
+}
 message_t * phev_core_extractAndDecodeOutgoingMessageAndXOR(const uint8_t *data)
 {
     LOG_V(APP_TAG, "START - extractAndDecodeOutgoingMessageAndXOR");
@@ -558,7 +687,7 @@ int phev_core_decodeMessage(const uint8_t *data, const size_t len, phevMessage_t
         return 0;
     }
 
-    message_t * message = phev_core_extractAndDecodeIncomingMessageAndXOR(data);
+    message_t * message = phev_core_extractAndDecodeIncomingMessageAndXORBounded(data, len);
 
     if (message)
     {

src/phev_pipe.c

@@ -238,7 +238,7 @@ message_t *phev_pipe_outputChainInputTransformer(void *ctx, message_t *message)
     {
         LOG_E(APP_TAG, "Invalid message received");
 
-        msg_utils_destroyMsg(message);
+        free(phevMessage);
         return NULL;
     }
     if(message->ctx != NULL)
@@ -820,7 +820,7 @@ messageBundle_t *phev_pipe_outputSplitter(void *ctx, message_t *message)
     }
     LOG_BUFFER_HEXDUMP(APP_TAG, message->data, message->length, LOG_DEBUG);
 
-    message_t * out = phev_core_extractIncomingMessageAndXOR(message->data);
+    message_t * out = phev_core_extractIncomingMessageAndXORBounded(message->data, message->length);
 
     if (out == NULL)
     {
@@ -843,7 +843,7 @@ messageBundle_t *phev_pipe_outputSplitter(void *ctx, message_t *message)
 
     while (message->length > total)
     {
-        out = phev_core_extractIncomingMessageAndXOR(message->data + total);
+        out = phev_core_extractIncomingMessageAndXORBounded(message->data + total, message->length - total);
         if (out == NULL) {
             break;
         }

test/test_phev_core.c

@@ -32,7 +32,7 @@ void test_phev_core_extractAndDecodeIncomingMessageAndXOR(void)
     uint8_t input[] = { 0x4f,0x26,0x20,0x23,0x21,0x31,0x43,0xcd };
     uint8_t expected[] = { 0x6f,0x06,0x00,0x03,0x01,0x11,0x63,0xed};
 
-    message_t * message = phev_core_extractAndDecodeIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractAndDecodeIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_MEMORY(expected,message->data,sizeof(expected));
@@ -792,7 +792,7 @@ void test_phev_core_decodeMessage_command_response(void)
 void test_core_phev_core_extractIncomingMessageAndXOR_valid_ping_in_clear(void)
 {
     uint8_t input[] = { 0x3f,0x04,0x01,0x00,0x00,0x44 };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -801,7 +801,7 @@ void test_core_phev_core_extractIncomingMessageAndXOR_valid_ping_in_clear(void)
 void test_core_phev_core_extractIncomingMessageAndXOR_valid_ping_encoded(void)
 {
     uint8_t input[] = { 0xa1,0x9a,0x9f,0x96,0x9e,0xd2 };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -811,7 +811,7 @@ void test_core_phev_core_extractIncomingMessageAndXOR_valid_ping_encoded(void)
 void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_response_in_clear(void)
 {
     uint8_t input[] = { 0x6F,0x04,0x01,0x07,0x00,0x7B };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -820,7 +820,7 @@ void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_response_in_
 void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_response_encoded(void)
 {
     uint8_t input[] = { 0x5F,0x34,0x31,0x35,0x30,0x49 }; // 6F 04 01 05 00 79
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -830,7 +830,7 @@ void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_response_enc
 void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_request_in_clear(void)
 {
     uint8_t input[] = { 0x6F,0x04,0x00,0x1B,0x01,0x8F };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -839,7 +839,7 @@ void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_request_in_c
 void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_request_encoded(void)
 {
     uint8_t input[] = {  0xF1,0x9A,0x9E,0x85,0x9F,0x11 }; // 6F 04 00 1B 01 8F
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -849,7 +849,7 @@ void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_request_enco
 void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_start_in_clear(void)
 {
     uint8_t input[] = {  0x4E,0x0C,0x00,0x01,0x04,0x69,0x1D,0x04,0x61,0x94,0xF2,0x3F,0x02,0x11 };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -859,14 +859,14 @@ void test_core_phev_core_extractIncomingMessageAndXOR_valid_command_start_in_cle
 void test_core_phev_core_extractIncomingMessageAndXOR_invalid_command(void)
 {
     uint8_t input[] = {  0x4F,0x0C,0x00,0x01,0x04,0x69,0x1D,0x04,0x61,0x94,0xF2,0x3F,0x02,0x11 };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NULL(message);
 }
 void test_core_phev_core_extractIncomingMessageAndXOR_BB_command(void)
 {
     uint8_t input[] = { 0xB1,0x0E,0x0B,0x91,0x00,0x6F };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -875,7 +875,7 @@ void test_core_phev_core_extractIncomingMessageAndXOR_BB_command(void)
 void test_core_phev_core_extractIncomingMessageAndXOR_CC_command(void)
 {
     uint8_t input[] = {0xDE,0x16,0x13,0xC4,0x3B,0xC2 };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -884,7 +884,7 @@ void test_core_phev_core_extractIncomingMessageAndXOR_CC_command(void)
 void test_core_phev_core_extractIncomingMessageAndXOR_2F_command(void)
 {
     uint8_t input[] = {0x3A,0x16,0x15,0x14,0x26 };
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
@@ -893,12 +893,11 @@ void test_core_phev_core_extractIncomingMessageAndXOR_2F_command(void)
 void test_core_phev_core_extractIncomingMessageValidFirstByteCommand(void)
 {
     uint8_t input[]= {0x6f,0xa7,0xa2,0x8b,0x62,0x19};
-    uint8_t expected[] = {0xcc,0x04,0x28,0x8b,0xba};
-    message_t * message = phev_core_extractIncomingMessageAndXOR(input);
+    message_t * message = phev_core_extractIncomingMessageAndXORBounded(input, sizeof(input));
 
     TEST_ASSERT_NOT_NULL(message);
-    TEST_ASSERT_EQUAL_HEX8_ARRAY(expected,message->data,sizeof(expected));
-    
+    TEST_ASSERT_EQUAL_HEX8_ARRAY(input,message->data,sizeof(input));
+    TEST_ASSERT_EQUAL(0xa3,phev_core_getMessageXOR(message));
 }
 /*
 void test_phev_core_decode_encode(void)

test/test_phev_pipe.c

@@ -1229,6 +1229,7 @@ void test_phev_pipe_updateRegisterWithCallback_encoded(void)
     };
     phev_pipe_ctx_t * ctx =  phev_pipe_createPipe(settings);
     ctx->currentXOR = 0x0d;
+    ctx->commandXOR = 0x0d;
 
     phev_pipe_updateRegisterWithCallback(ctx, KO_WF_H_LAMP_CONT_SP, 1,(phev_pipe_updateRegisterCallback_t) test_phev_pipe_update_register_callback,NULL);
 

test/test_phev_service.c

@@ -944,7 +944,7 @@ void test_phev_service_end_to_end_operations(void)
 {
     const char * commands = "{ \"requests\": [{ \"operation\" :  { \"airCon\" : \"on\" } }, { \"operation\" :  { \"headLights\" : \"off\" } } ] }";
 
-    const uint8_t expected[] = {0xf6,0x04,0x00,0x04,0x02,0x00,0xf6,0x04,0x00,0x0a,0x02,0x06};
+    const uint8_t expected_headlights_off[] = {0xf6,0x04,0x00,0x0a,0x02,0x06};
 
     test_phev_service_global_in_in_message = msg_utils_createMsg(commands, strlen(commands));
 
@@ -964,7 +964,7 @@ void test_phev_service_end_to_end_operations(void)
 
     phev_pipe_loop(ctx->pipe);
     TEST_ASSERT_NOT_NULL(test_phev_service_global_out_out_message);
-    TEST_ASSERT_EQUAL_MEMORY(expected, test_phev_service_global_out_out_message->data,sizeof(expected));
+    TEST_ASSERT_EQUAL_MEMORY(expected_headlights_off, test_phev_service_global_out_out_message->data,sizeof(expected_headlights_off));
 
 }
 void test_phev_service_end_to_end_updated_register(void)