-
Notifications
You must be signed in to change notification settings - Fork 687
Open
Description
The code of getNtpTime() in https://github.com/PaulStoffregen/Time/blob/master/examples/TimeNTP/TimeNTP.ino doesn't check the correctness of UDP packet's content (obtained from NTP server), and can potentially set invalid date (in future - 07-Feb-2036).
I'm referring to this code fragment:
if (size >= NTP_PACKET_SIZE) {
Serial.println("Receive NTP Response");
Udp.read(packetBuffer, NTP_PACKET_SIZE); // read packet into the buffer
unsigned long secsSince1900;
// convert four bytes starting at location 40 to a long integer
secsSince1900 = (unsigned long)packetBuffer[40] << 24;
secsSince1900 |= (unsigned long)packetBuffer[41] << 16;
secsSince1900 |= (unsigned long)packetBuffer[42] << 8;
secsSince1900 |= (unsigned long)packetBuffer[43];
return secsSince1900 - 2208988800UL + timeZone * SECS_PER_HOUR;
}
Here secsSince1900 can be zero, when in certain cases ( like "rate limiting" - mentioned in arduino-libraries/NTPClient#84 ) NTP responds with zero time.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels