- MMS server: fixed bug in handling of continueAfter parameter of getNameList request (LIB61850-341)

src/mms/iso_mms/server/mms_get_namelist_service.c

@@ -515,6 +515,7 @@ mmsServer_handleGetNameListRequest(
     char* continueAfterId = NULL;
 
     if (continueAfter != NULL) {
+        if (continueAfterLength < 130) {
             continueAfterId = continueAfterIdMemory;
             memcpy(continueAfterId, continueAfter, continueAfterLength);
             continueAfterId[continueAfterLength] = 0;
@@ -522,6 +523,14 @@ mmsServer_handleGetNameListRequest(
             if (DEBUG_MMS_SERVER)
                 printf("MMS_SERVER: getNameListRequest - continue after: (%s)\n", continueAfterId);
         }
+        else {
+            if (DEBUG_MMS_SERVER)
+                printf("MMS_SERVER: getNameListRequest - continuer after variable name too long\n");
+
+            mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
+            return;
+        }
+    }
 
     if (objectScope == OBJECT_SCOPE_DOMAIN) {
         char domainSpecificName[130];