FlorianandClaude Opus 4.7
0b6780678f
Follow-up to #2321. That PR fixed five strcpy sites in XtoSYS/createOrUpdateDevice but left adjacent attack surfaces using the same pattern (strncpy with the destination's own size, leaving the buffer non-NUL-terminated when the source is at the limit; or strcpy of WiFiManager/HTTP form values that bypass the client-side maxlength). The over-long string then flows into saveConfig() and back into a strcpy on next boot, corrupting heap/.bss on every reload. main/main.cpp - XtoSYS: length-check before copying mqtt_topic, discovery_prefix, gateway_name, gw_pass (ota_pass), and ble_aes. Reject over-length with THEENGS_LOG_WARNING, preserving existing values. main/main.cpp - loadConfigFromFlash: new loadStrField() helper applies the same guard to every SPIFFS-loaded string (mqtt_server/port/user/pass per slot, mqtt_topic, discovery_prefix, gateway_name, ota_pass, ble_aes). Defense in depth in case a pre-fix build left an over-length value in /config.json. main/main.cpp - WiFiManager save: bound mqtt_topic against the 150-byte portal buffer overflowing the 66-byte destination (HTML maxlength is client-side only; a raw POST bypasses it). main/webUI.cpp - handleCG /gw save: bound gateway-password form input before the strncpy that previously left ota_pass non-NUL-terminated. main/blufi.cpp - ESP_BLUFI_EVENT_RECV_STA_SSID/PASSWD: clamp the wire-supplied ssid_len/passwd_len before the memcpy and the trailing NUL so a crafted BluFi provisioning frame cannot overrun gl_sta_ssid[32]/gl_sta_passwd[64]. main/gatewayBT.cpp - BLEDecryptor (Victron, encr==3): remove `nonce[16] = {0}`, a one-byte stack-OOB write reachable from any BLE adv. The line was dead (the memset two lines later zeroes the whole array); deleting it eliminates the OOB write. main/gatewaySRFB.cpp - SRFBtoX: bound the _uartbuf writer so a 433 MHz frame with no STOP can no longer let _uartpos grow past sizeof(_uartbuf). main/gatewaySRFB.cpp - _rfbSend: the hex output buffer was sized RF_MESSAGE_SIZE (9) but _rawToHex writes 2*N+2 bytes per call. Resize to fit. Tested on a Theengs Bridge: built theengs-bridge-v11 env, OTA-flashed, and verified that publishing {"discovery_prefix":"Z"*200} to MQTTtoSYS/config leaves discovery_prefix unchanged (no Z*65 truncation in subsequent discovery topics), bridge keeps decoding BLE adverts, and SYStoMQTT/LWT stay healthy. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
OpenMQTTGateway aims to unify various technologies and protocols into a single firmware. This reduces the need for multiple physical bridges and streamlines diverse technologies under the widely-used MQTT protocol.
Sponsors
Documentation
The documentation is here
The reference sheet, with the list of all functions, pinouts is here
Upload
Upload OpenMQTTGateway directly from the upload page (no additional software required) or build your own configuration with PlatformIO.
Using OpenMQTTGateway ?
Support open-source development through sponsorship and gain exclusive access to our private forum. Your questions, issues, and feature requests will receive priority attention, plus you'll gain insider access to our roadmap.
Products powered by OpenMQTTGateway
Theengs Bridge, Bluetooth gateway (BLE) with external antenna
Theengs bridge is a powerfull BLE to MQTT gateway for over 100 sensors. Equipped with an Ethernet port, and external antenna, ensuring an enhanced range for your BLE sensors. It supports also WiFi connectivity.
Theengs Plug, Bluetooth gateway (BLE) gateway and Smart Plug
Theengs plug brings the following features:
- BLE to MQTT gateway, tens of Bluetooth devices supported thanks to Theengs Decoder library. The plug uses an ESP32 acting as a BLE to Wifi gateway to scan, decode and forward the data of the nearby sensors,
- Smart plug that can be controlled remotely,
- Energy consumption monitoring,
- Device tracker,
- Presence detection (beta),
- Local connectivity first.
Support the project by purchasing the Theengs bridge or the Theengs plug
Compatible items
-
List of supported devices, door/window sensors, PIR sensors, smoke detectors, weather stations...
-
List of compatible boards (Off the shelf or DIY) is available, RF Bridge, IR, BLE gateways...
Running on a computer If you want to use the BLE decoding capabilities of OpenMQTTGateway with a Raspberry Pi, Windows or Unix PC you can now leverage Theengs Gateway.
- List of compatible components to build your gateway, DHT, RF, IR emitters and receivers...
Compatible controllers, saas or software
Contributors ✨
Thanks goes to these wonderful people who helped OpenMQTTGateway on Github and to the users contributions into the community.
Support
For Questions or Support please don't open an issue, first go to the docs and if you don't find your answer there, you can post your question in the community forum
Help
If you like the project and/or used it please consider supporting it! It can be done in different ways:
- Helping other users in the community
- Contribute to the code or the documentation
- Buy a Theengs plug or a Theengs bridge
- Donate or sponsor the project developers
- Make a video or a blog article about what you have done with OpenMQTTGateway and share it to the community
Media
- Hackaday - ARDUINO LIBRARY BRINGS RTL_433 TO THE ESP32
- CNX Software - 433 MHz is not dead! Using an ESP32 board with LoRa module to talk to 433 MHz sensors
- RTL_433 PORTED TO ESP32 MICROCONTROLLERS WITH CC1101 OR SX127X TRANSCEIVER CHIPS
- Using low-cost wireless sensors in the unlicensed bands
- SMART PLUG ESP32 OPENMQTTGATEWAY SERVING AS AN BLE MQTT GATEWAY AND A POWER METER
Theengs Plug
433Mhz and BLE
BLE
433Mhz
LORA
