fix(cc/nif): Allocate more space for NIF to unpacking extended cc

Origin: #125
Bug-SiliconLabs: UIC-3664
Relate-to: SLVDBBP-3162484
Relate-to: SiliconLabsSoftware/z-wave-engine-application-layer#42
Co-authored-by: Laudin Molina Troconis <laudin.molinatroconis@silabs.com>
Signed-off-by: Philippe Coval <philippe.coval@silabs.com>

Author: rzr

applications/zpc/components/zwave/zwave_controller/src/zwave_controller_utils.c

@@ -286,11 +286,18 @@ void zwave_command_class_list_unpack(zwave_node_info_t *node_info,
          && (i < ZWAVE_CONTROLLER_MAXIMUM_COMMAND_CLASS_LIST_LENGTH)) {
     // Check if it's extended CC format (2 bytes length). Check
     // CC:0000.00.00.11.001 for more details
-    if (((nif[nif_index] & 0xF0) == 0xF0) && (nif_index < nif_length - 1)) {
-      node_info->command_class_list[i]
-        = ((nif[nif_index] & 0xFF) << 8) | nif[nif_index + 1];
-      i++;
-      nif_index += 2;
+    if (nif[nif_index] >= 0xF1) {  // Belong to extended range
+      if (nif_index < nif_length - 1) { // Prevent read beyond
+        node_info->command_class_list[i]
+          = ((nif[nif_index] & 0xFF) << 8) | nif[nif_index + 1];
+        i++;
+        nif_index += 2;
+      } else {
+          sl_log_warning(
+              LOG_TAG,
+              "warning: zwave_command_class_list_unpack: invalid input: skipping");
+          assert(false);
+      }
     } else {
       node_info->command_class_list[i++] = nif[nif_index++];
     }
@@ -303,10 +310,13 @@ void zwave_command_class_list_pack(const zwave_node_info_t *node_info,
                                    uint8_t *nif_length)
 {
   uint8_t nif_index = 0;
+
+  assert(node_info->command_class_list_length
+         <= ZWAVE_CONTROLLER_MAXIMUM_COMMAND_CLASS_LIST_LENGTH);
   for (uint8_t i = 0; i < node_info->command_class_list_length
                       && i < ZWAVE_CONTROLLER_MAXIMUM_COMMAND_CLASS_LIST_LENGTH;
        i++) {
-    if (node_info->command_class_list[i] >= 0xF0) {
+    if (node_info->command_class_list[i] > 0xFF) {  // Ext (2 bytes ids)
       nif[nif_index++] = node_info->command_class_list[i] >> 8;
       nif[nif_index++] = node_info->command_class_list[i];
     } else {

applications/zpc/components/zwave_command_classes/src/zwave_command_class_node_info_resolver.c

@@ -267,8 +267,9 @@ static void on_node_information_update(zwave_node_id_t node_id,
     = attribute_store_get_first_child_by_type(endpoint_id_node,
                                               ATTRIBUTE_ZWAVE_NIF);
 
-  // Pack the NIF data into a nif array:
-  uint8_t nif[ZWAVE_CONTROLLER_MAXIMUM_COMMAND_CLASS_LIST_LENGTH];
+  // Pack the NIF data into a nif array
+  // The size is 2 * ZWAVE_CONTROLLER_MAXIMUM_COMMAND_CLASS_LIST_LENGTH because Generic Extended Command Classes are 2-byte long
+  uint8_t nif[ZWAVE_CONTROLLER_MAXIMUM_COMMAND_CLASS_LIST_LENGTH * 2];
   uint8_t nif_length = 0;
   zwave_command_class_list_pack(node_info, nif, &nif_length);
 
@@ -280,13 +281,14 @@ static void on_node_information_update(zwave_node_id_t node_id,
         node_id,
         nif,
         nif_length)) {
-    if (nif_length >= ZWAVE_CONTROLLER_MAXIMUM_COMMAND_CLASS_LIST_LENGTH) {
-      // Overflow, just return and toss the faulty NIF.
-      return;
-    }
-    // Keep S2 in the NIF !
-    nif[nif_length] = COMMAND_CLASS_SECURITY_2;
-    nif_length += 1;
+      if (nif_length < sizeof(nif)) {
+          // Keep S2 in the NIF !
+          nif[nif_length] = COMMAND_CLASS_SECURITY_2;
+          nif_length += 1;
+      } else {
+          // Overflow, just return and toss the faulty NIF.
+          return;
+      }
   }
 
   attribute_store_set_reported(non_secure_nif_node, nif, nif_length);