dali/bacnet_stack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix bacdevobjpropref module decode buffer overflow reads (#541)

Browse Source 
Co-authored-by: Steve Karg <skarg@users.sourceforge.net>
This commit is contained in:
Steve Karg
2023-11-29 15:44:58 -06:00
committed by GitHub
parent 241cd2994f
commit 9780f52640
7 changed files with 645 additions and 448 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/bacnet/basic/object/trendlog.c
+4 -7
View File
@@ -680,17 +680,14 @@ bool Trend_Log_Write_Property(BACNET_WRITE_PROPERTY_DATA *wp_data)
break;
case PROP_LOG_DEVICE_OBJECT_PROPERTY:
len = bacapp_decode_device_obj_property_ref(
wp_data->application_data, &TempSource);
if ((len < 0) ||
(len > wp_data->application_data_len)) /* Hmm, that didn't go */
/* as planned... */
{
len = bacnet_device_object_property_reference_decode(
wp_data->application_data,wp_data->application_data_len,
&TempSource);
if (len <= 0) {
wp_data->error_class = ERROR_CLASS_PROPERTY;
wp_data->error_code = ERROR_CODE_OTHER;
break;
}
/* We only support references to objects in ourself for now */
if ((TempSource.deviceIdentifier.type == OBJECT_DEVICE) &&
(TempSource.deviceIdentifier.instance !=