From 87f573b7215cfa1aecba00a1c54b5ee3fe701e6b Mon Sep 17 00:00:00 2001 From: Pablo Ventura Date: Tue, 18 Aug 2026 11:24:09 -0300 Subject: [PATCH 1/2] ntptime: Reject Kiss-o-Death and zero timestamps. Signed-off-by: Pablo Ventura --- micropython/net/ntptime/ntptime.py | 2 ++ micropython/net/ntptime/test_ntptime.py | 29 ++++++++++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/micropython/net/ntptime/ntptime.py b/micropython/net/ntptime/ntptime.py index 2402a6276..d42c54d94 100644 --- a/micropython/net/ntptime/ntptime.py +++ b/micropython/net/ntptime/ntptime.py @@ -22,6 +22,8 @@ def time(): if len(msg) < 48: raise OSError(-1) val = struct.unpack("!I", msg[40:44])[0] + if msg[1] == 0 or val == 0: + raise OSError(-1) # 2024-01-01 00:00:00 converted to an NTP timestamp MIN_NTP_TIMESTAMP = 3913056000 diff --git a/micropython/net/ntptime/test_ntptime.py b/micropython/net/ntptime/test_ntptime.py index 2a868e824..acc83c06b 100644 --- a/micropython/net/ntptime/test_ntptime.py +++ b/micropython/net/ntptime/test_ntptime.py @@ -38,8 +38,9 @@ def socket(self, *a, **k): import ntptime -def ntp_msg(ts=3913056000): +def ntp_msg(ts=3913056000, stratum=2): msg = bytearray(48) + msg[1] = stratum struct.pack_into("!I", msg, 40, ts) return bytes(msg) @@ -71,5 +72,31 @@ def test_time_short_raises(): ntptime.socket = orig +def test_time_kod_stratum_raises(): + orig = _patch(ntp_msg(stratum=0)) + try: + try: + ntptime.time() + assert False, "expected OSError" + except OSError as e: + assert e.args == (-1,) + finally: + ntptime.socket = orig + + +def test_time_zero_ts_raises(): + orig = _patch(ntp_msg(ts=0)) + try: + try: + ntptime.time() + assert False, "expected OSError" + except OSError as e: + assert e.args == (-1,) + finally: + ntptime.socket = orig + + test_time_ok() test_time_short_raises() +test_time_kod_stratum_raises() +test_time_zero_ts_raises() From d258999472b65fcf26756d8e9be1d5cf91d86477 Mon Sep 17 00:00:00 2001 From: Pablo Ventura Date: Tue, 18 Aug 2026 13:14:31 -0300 Subject: [PATCH 2/2] ntptime: Compact Kiss-o-Death and zero timestamp check. Signed-off-by: Pablo Ventura --- micropython/net/ntptime/ntptime.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/micropython/net/ntptime/ntptime.py b/micropython/net/ntptime/ntptime.py index d42c54d94..de161a2f0 100644 --- a/micropython/net/ntptime/ntptime.py +++ b/micropython/net/ntptime/ntptime.py @@ -22,7 +22,7 @@ def time(): if len(msg) < 48: raise OSError(-1) val = struct.unpack("!I", msg[40:44])[0] - if msg[1] == 0 or val == 0: + if not (msg[1] and val): raise OSError(-1) # 2024-01-01 00:00:00 converted to an NTP timestamp