GithubStar/open62541
1
0
Fork 0
mirror of https://github.com/open62541/open62541.git synced 2026-10-17 04:42:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): validate ExtensionObject length without pointer overflow

Browse Source 
Compare the declared body length with the remaining input before computing the
end pointer. This avoids undefined pointer arithmetic for oversized lengths.

Correct the bounds checks introduced by 57142d6b4.
This commit is contained in:
Julius Pfrommer
2026-08-16 00:01:32 +02:00
committed by Julius Pfrommer
parent 150706770f
commit a68d6deeb7
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ua_types_encoding_binary.c
+3 -2
View File
@@ -904,7 +904,8 @@ ExtensionObject_decodeBinaryContent(UA_ExtensionObject *dst, const UA_NodeId *ty
u32 member_length = 0;
status ret = DECODE_DIRECT(&member_length, UInt32);
UA_CHECK_STATUS(ret, return ret);
UA_CHECK(ctx->pos + member_length <= ctx->end, return UA_STATUSCODE_BADDECODINGERROR);
UA_CHECK(member_length <= (size_t)(ctx->end - ctx->pos),
return UA_STATUSCODE_BADDECODINGERROR);
const u8 *expected_end = ctx->pos + member_length;
/* Decode */
@@ -1076,7 +1077,7 @@ Variant_decodeBinaryUnwrapExtensionObject(UA_Variant *dst, Ctx *ctx) {
u32 member_length = 0;
ret = DECODE_DIRECT(&member_length, UInt32);
UA_CHECK_STATUS(ret, UA_NodeId_clear(&typeId); return ret);
UA_CHECK(ctx->pos + member_length <= ctx->end,
UA_CHECK(member_length <= (size_t)(ctx->end - ctx->pos),
UA_NodeId_clear(&typeId); return UA_STATUSCODE_BADDECODINGERROR);
expected_end = ctx->pos + member_length;
} else {