From 3bc94bf1bd1bbbe05f35230257f8fcec0bb58c68 Mon Sep 17 00:00:00 2001 From: Michael Zillgith Date: Tue, 23 Jul 2024 18:50:15 +0100 Subject: [PATCH] - fixed potential buffer overflows in MMS client file service handling (LIB61850-449) --- src/mms/iso_mms/client/mms_client_files.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/src/mms/iso_mms/client/mms_client_files.c b/src/mms/iso_mms/client/mms_client_files.c index 4fca418e..935ba1a4 100644 --- a/src/mms/iso_mms/client/mms_client_files.c +++ b/src/mms/iso_mms/client/mms_client_files.c @@ -487,8 +487,13 @@ parseFileAttributes(uint8_t* buffer, int bufPos, int maxBufPos, uint32_t* fileSi break; case 0x81: /* lastModified */ { - if (lastModified != NULL) { + if (lastModified != NULL) + { char gtString[40]; + + if (length > sizeof(gtString) - 1) + return false; /* lastModified string too long */ + memcpy(gtString, buffer + bufPos, length); gtString[length] = 0; *lastModified = Conversions_generalizedTimeToMsTime(gtString); @@ -515,12 +520,14 @@ parseDirectoryEntry(uint8_t* buffer, int bufPos, int maxBufPos, uint32_t invokeI uint32_t fileSize = 0; uint64_t lastModified = 0; - while (bufPos < maxBufPos) { + while (bufPos < maxBufPos) + { uint8_t tag = buffer[bufPos++]; int length; bufPos = BerDecoder_decodeLength(buffer, &length, bufPos, maxBufPos); - if (bufPos < 0) { + if (bufPos < 0) + { if (DEBUG_MMS_CLIENT) printf("MMS_CLIENT: invalid length field\n"); return false; @@ -534,12 +541,20 @@ parseDirectoryEntry(uint8_t* buffer, int bufPos, int maxBufPos, uint32_t invokeI tag = buffer[bufPos++]; bufPos = BerDecoder_decodeLength(buffer, &length, bufPos, maxBufPos); - if (bufPos < 0) { + if (bufPos < 0) + { if (DEBUG_MMS_CLIENT) printf("MMS_CLIENT: invalid length field\n"); return false; } + if (length > (sizeof(fileNameMemory) - 1)) + { + if (DEBUG_MMS_CLIENT) + printf("MMS_CLIENT: filename too long\n"); + return false; + } + memcpy(filename, buffer + bufPos, length); filename[length] = 0;