HeapCrash / Challenges / TLV provisioning parser

TLV provisioning parser

Parses Wi-Fi provisioning data received over BLE. g_ssid is char[33]. Length-handling bugs like these are behind many real CVEs in embedded network stacks.

The code

Embedded C for Cortex-M. It compiles. There are 4 real bugs in it: the kind that pass a bench test and fail in the field.

void parse_tlv(const uint8_t *buf, size_t len)
{
    size_t i = 0;
    while (i < len) {
        uint8_t type = buf[i];
        uint8_t l    = buf[i + 1];
        const uint8_t *val = &buf[i + 2];

        switch (type) {
        case T_SSID:
            memcpy(g_ssid, val, l);
            break;
        case T_CHANNEL:
            g_channel = val[0];
            break;
        }
        i += 2 + l;
    }
}

What an interviewer expects

The bugs, reference fixes and the follow-up question are in the practice app, after you've tried it.

Companies that test this

Matched on the skills each company's embedded roles emphasise.

Related challenges

Flag the lines, say what breaks, then fix it and build it with clang in your browser.

Find the bugs