blackmutzi / alexa-avs-prototype

Alexa Voice Service (AVS) client in C++ for raspberry pi or any Linux Distribution

alexa-avs-prototype (c++)

Alexa Voice Service (AVS) client in c++ for raspberry pi or any Linux Distribution. Project tested on Gentoo(x86_64) and Raspbian(arm).

The Prototype is deprecated use alexa-sdk-framewok/alexa-amazon-client, is already released and has more improvment.

what you need?

• A Linux Distribution with PulseAudio Support.
• Amazon Developer Account.
• Follow the steps here to create a security profile.
• And a WakeWordEngine Client from here.

download && build

git clone https://github.com/blackmutzi/alexa-avs-prototype
cd ./alexa-avs-prototype
qmake ./src/alexa-avs-prototype.pro
make

avs-configuration

first Step

go to config directory and modify ./src/config/config.json file

cd ./alexa-avs-prototype/src/config/
nano config.json 

{
 "client_id":" YOUR_CLIENT_ID_HERE ",
 "client_secret":" YOUR_CLIENT_SECRET_ID_HERE ",
 "code_grant":" YOUR_CODE_GRANT_HERE",
 "product_id":" YOUR_PRODUCT_NAME_HERE ",
 "redirect_uri":"https://localhost:3000/authresponse",
 "refresh_token":"AVS-CLIENT_SET_TOKEN_AUTOMATIC"
}

and write client_id, client_secret and product_id into the config. ( @see amazon-security-profile )

second Step

start now prototype ...

./alexa-avs-prototype

the avs-client show you a link, copy it in your Browser. Login Now ..

and get the grant code, save the grant code in the ./alexa-avs-prototype/src/config/config.json file, finish.

depends installing ( debian )

install:
  - sudo apt-get install libcurl4-gnutls-dev
  - sudo apt-get install libboost-all-dev
  - sudo apt-get install gcc-4.9
  - sudo apt-get install g++-4.9
  - sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-4.9 100
  - sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.9 100
  - sudo add-apt-repository -y "deb http://de.archive.ubuntu.com/ubuntu artful main restricted universe multiverse"
  - sudo apt-get update -qq
  - sudo apt-get install libnghttp2-dev
  - sudo apt-get install libevent-dev
  - sudo apt-get install libmp3lame-dev
  - sudo apt-get install libssl-dev
  - sudo apt-get install libasound2-dev

alexa-avs-prototype's Issues

Academic research on vulnerable c++ code snippet

Dear Stefan M.,
We are a group of Academic researchers. We are analyzing vulnerable C++ code snippets migrated from StackOverflow to GitHub. Our research will be published in Academic publications and will not be used in any Industrial application.
We noted a vulnerable code snippet in your repository that was most likely copied from Stack Overflow. The vulnerability exists in this source code file of your repository.

Please verify our report here with regards to the above vulnerability to assist you.
Link to report with four questions for you related to the vulnerability (should not take more than 5 minutes to answer).

Here is a summary of the vulnerable code snippet:

Description:

If current_index or current_index + sizeof(T) get larger than size of vec, information leakage can occur.

static T get_from_vector(const std::vector<uint8_t>& vec, const size_t current_index){

example:

int main(){
std::vector<uint8_t> vec {0x01, 0x05};
auto byte1 = get_from_vector<uint8_t>(vec, 10);
auto byte2 = get_from_vector<uint16_t>(vec, 20);
auto byte4 = get_from_vector<uint32_t>(vec, 50);
auto byte8 = get_from_vector<uint64_t>(vec, 32);
printf("%x - %x -%x -%x",byte1,byte2,byte4,byte8);
}

output it's being like this:

0 - 0 -0 -382d3531

Mitigation:

Validate size of current_index + sizeof(T) to always be in the boundary of vec.

---

Please verify our report here with regards to the above vulnerability to assist you.
Link to report with four questions for you related to the vulnerability (should not take more than 5 minutes to answer).

Sincerely yours,
Morteza Verdi, Shiraz university, E-mail: [email protected]
Jafar Akhondali, Shiraz university, E-mail: [email protected]
Ashkan Sami, Shiraz university, E-mail: [email protected]
Foutse Khomh, Polytechnique Montreal, E-mail: [email protected], website: http://www.khomh.net/
Gias Uddin, Polytechnique Montreal, E-mail: [email protected], website: https://giasuddin.github.io
Alireza Karami motlagh, Shahid Chamran University, E-mail: [email protected]