RYTEC
/
libiec61850
mirror of https://github.com/mz-automation/libiec61850.git
6
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- added type checks when using asn1c parsing results for whole MmsPdu (LIB61850-343)

Browse Source
pull/396/head
Michael Zillgith 3 years ago
parent aeb8cb6157
commit 1615c8ea9a
8 changed files with 99 additions and 66 deletions
Show Stats Download Patch File Download Diff File

2
src/mms/iso_mms/client/mms_client_connection.c
Unescape Escape View File

@ -66,7 +66,7 @@ static void
handleUnconfirmedMmsPdu(MmsConnection self, ByteBuffer* message)
{
if (self->reportHandler != NULL) {
MmsPdu_t* mmsPdu = 0; /* allow asn1c to allocate structure */
MmsPdu_t* mmsPdu = NULL; /* allow asn1c to allocate structure */
if (DEBUG_MMS_CLIENT)
printf("MMS_CLIENT: report handler rcvd size:%i\n", ByteBuffer_getSize(message));

2
src/mms/iso_mms/client/mms_client_files.c
Unescape Escape View File

@ -1,7 +1,7 @@
/*
* mms_client_files.c
*
* Copyright 2013 - 2016 Michael Zillgith
* Copyright 2013 - 2022 Michael Zillgith
*
* This file is part of libIEC61850.
*

4
src/mms/iso_mms/client/mms_client_get_var_access.c
Unescape Escape View File

@ -1,7 +1,7 @@
/*
* mms_client_get_var_access.c
*
* Copyright 2013-2018 Michael Zillgith
* Copyright 2013-2022 Michael Zillgith
*
* This file is part of libIEC61850.
*
@ -132,7 +132,7 @@ createTypeSpecification(TypeSpecification_t* asnTypeSpec)
MmsVariableSpecification*
mmsClient_parseGetVariableAccessAttributesResponse(ByteBuffer* message, uint32_t* invokeId)
{
MmsPdu_t* mmsPdu = 0; /* allow asn1c to allocate structure */
MmsPdu_t* mmsPdu = NULL; /* allow asn1c to allocate structure */
MmsVariableSpecification* typeSpec = NULL;
asn_dec_rval_t rval = ber_decode(NULL, &asn_DEF_MmsPdu,

6
src/mms/iso_mms/client/mms_client_named_variable_list.c
Unescape Escape View File

@ -119,7 +119,7 @@ mmsClient_createDeleteAssociationSpecificNamedVariableListRequest(
bool
mmsClient_parseDeleteNamedVariableListResponse(ByteBuffer* message, uint32_t* invokeId, long* numberDeleted, long* numberMatched)
{
MmsPdu_t* mmsPdu = 0;
MmsPdu_t* mmsPdu = NULL;
bool retVal = false;
@ -299,7 +299,7 @@ parseNamedVariableAttributes(GetNamedVariableListAttributesResponse_t* response,
LinkedList /* <MmsVariableAccessSpecification*> */
mmsClient_parseGetNamedVariableListAttributesResponse(ByteBuffer* message, bool* /*OUT*/deletable)
{
MmsPdu_t* mmsPdu = 0;
MmsPdu_t* mmsPdu = NULL;
LinkedList attributes = NULL;
@ -430,7 +430,7 @@ mmsClient_createDefineNamedVariableListRequest(
bool
mmsClient_parseDefineNamedVariableResponse(ByteBuffer* message, uint32_t* invokeId)
{
MmsPdu_t* mmsPdu = 0;
MmsPdu_t* mmsPdu = NULL;
bool retVal = false;
asn_dec_rval_t rval;

2
src/mms/iso_mms/client/mms_client_read.c
Unescape Escape View File

@ -363,7 +363,7 @@ mmsClient_parseListOfAccessResults(AccessResult_t** accessResultList, int listSi
MmsValue*
mmsClient_parseReadResponse(ByteBuffer* message, uint32_t* invokeId, bool createArray)
{
MmsPdu_t* mmsPdu = 0; /* allow asn1c to allocate structure */
MmsPdu_t* mmsPdu = NULL; /* allow asn1c to allocate structure */
MmsValue* valueList = NULL;

23
src/mms/iso_mms/server/mms_named_variable_list_service.c
Unescape Escape View File

@ -120,9 +120,8 @@ mmsServer_handleDeleteNamedVariableListRequest(MmsServerConnection connection,
{
(void)bufPos;
DeleteNamedVariableListRequest_t* request = 0;
MmsPdu_t* mmsPdu = 0;
DeleteNamedVariableListRequest_t* request = NULL;
MmsPdu_t* mmsPdu = NULL;
asn_dec_rval_t rval = ber_decode(NULL, &asn_DEF_MmsPdu, (void**) &mmsPdu, buffer, maxBufPos);
@ -131,7 +130,16 @@ mmsServer_handleDeleteNamedVariableListRequest(MmsServerConnection connection,
goto exit_function;
}
if ((mmsPdu->present == MmsPdu_PR_confirmedRequestPdu) &&
(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.present
== ConfirmedServiceRequest_PR_deleteNamedVariableList))
{
request = &(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.choice.deleteNamedVariableList);
}
else {
mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
goto exit_function;
}
long scopeOfDelete = DeleteNamedVariableListRequest__scopeOfDelete_specific;
@ -458,7 +466,16 @@ mmsServer_handleDefineNamedVariableListRequest(
goto exit_free_struct;
}
if ((mmsPdu->present == MmsPdu_PR_confirmedRequestPdu) &&
(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.present
== ConfirmedServiceRequest_PR_defineNamedVariableList))
{
request = &(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.choice.defineNamedVariableList);
}
else {
mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
goto exit_free_struct;
}
MmsDevice* device = MmsServer_getDevice(connection->server);

17
src/mms/iso_mms/server/mms_read_service.c
Unescape Escape View File

@ -911,20 +911,27 @@ mmsServer_handleReadRequest(
ByteBuffer* response)
{
(void)bufPos;
(void)maxBufPos;
ReadRequest_t* request = 0; /* allow asn1c to allocate structure */
ReadRequest_t* request = NULL; /* allow asn1c to allocate structure */
MmsPdu_t* mmsPdu = NULL;
MmsPdu_t* mmsPdu = 0;
asn_dec_rval_t rval = ber_decode(NULL, &asn_DEF_MmsPdu, (void**) &mmsPdu, buffer, CONFIG_MMS_MAXIMUM_PDU_SIZE);
asn_dec_rval_t rval = ber_decode(NULL, &asn_DEF_MmsPdu, (void**) &mmsPdu, buffer, maxBufPos);
if (rval.code != RC_OK) {
mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
goto exit_function;
}
if ((mmsPdu->present == MmsPdu_PR_confirmedRequestPdu) &&
(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.present
== ConfirmedServiceRequest_PR_read))
{
request = &(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.choice.read);
}
else {
mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
goto exit_function;
}
if (request->variableAccessSpecification.present == VariableAccessSpecification_PR_listOfVariable) {
MmsServer_lockModel(connection->server);

19
src/mms/iso_mms/server/mms_write_service.c
Unescape Escape View File

@ -488,22 +488,31 @@ mmsServer_handleWriteRequest(
ByteBuffer* response)
{
(void)bufPos;
(void)maxBufPos;
MmsPdu_t* mmsPdu = 0;
MmsPdu_t* mmsPdu = NULL;
WriteRequest_t* writeRequest = NULL;
asn_dec_rval_t rval; /* Decoder return value */
rval = ber_decode(NULL, &asn_DEF_MmsPdu, (void**) &mmsPdu, buffer, CONFIG_MMS_MAXIMUM_PDU_SIZE);
rval = ber_decode(NULL, &asn_DEF_MmsPdu, (void**) &mmsPdu, buffer, maxBufPos);
if (rval.code != RC_OK) {
mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
goto exit_function;
}
MmsServer_lockModel(connection->server);
if ((mmsPdu->present == MmsPdu_PR_confirmedRequestPdu) &&
(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.present
== ConfirmedServiceRequest_PR_write))
{
writeRequest = &(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.choice.write);
}
else {
mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
goto exit_function;
}
WriteRequest_t* writeRequest = &(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.choice.write);
MmsServer_lockModel(connection->server);
if (writeRequest->variableAccessSpecification.present == VariableAccessSpecification_PR_variableListName) {
handleWriteNamedVariableListRequest(connection, writeRequest, invokeId, response);

Write Preview
Loading…
Cancel
Save