dali/bacnet_stack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #78 from se-apc/bugfix/stack_smashing_on_cov_subscriptions_encoding (#802)

Browse Source 
Resolving stack-smashing problem associated with variable length of subscriber's process ID 2..5 bytes

Co-authored-by: Tomasz Kazimierz Motyl <tomasz.motyl@se.com>
This commit is contained in:
Tomasz Kazimierz Motyl
2024-10-09 18:31:13 +01:00
committed by GitHub
parent 385c6bbd5d
commit bcb82841fb
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/bacnet/basic/service/h_cov.c
+4 -3
View File
@@ -276,10 +276,11 @@ static int cov_encode_subscription(
* @return How many bytes were encoded in the buffer, or -2 if the response * @return How many bytes were encoded in the buffer, or -2 if the response
* would not fit within the buffer. * would not fit within the buffer.
*/ */
/* Maximume length for an encoded COV subscription - 27 bytes for BACNET IP6 /* Maximume length for an encoded COV subscription - 31 bytes for BACNET IP6
* 31 bytes for IPv4 (longest MAC) and lets round it up to the machine word * 35 bytes for IPv4 (longest MAC) with the maximum length
* of PID (5 bytes) and lets round it up to the 64bit machine word
* alignment */ * alignment */
#define MAX_COV_SUB_SIZE (32) #define MAX_COV_SUB_SIZE (40)
int handler_cov_encode_subscriptions(uint8_t *apdu, int max_apdu) int handler_cov_encode_subscriptions(uint8_t *apdu, int max_apdu)
{ {
if (apdu) { if (apdu) {