mirror of
https://github.com/open62541/open62541.git
synced 2026-10-29 13:20:10 +08:00
Niels Beier
f828c6051d
In getHistoryData_service_default(), the outer continuation point encodes a skip count that was read directly from client-controlled bytes without validation. Two independent arithmetic errors could cause a heap-buffer- overflow in the subsequent backend copy call: 1. When skip > _resultSize, the subtraction `_resultSize - skip` wraps around in size_t, producing a very large value. After clamping to maxSize, the allocation is correct, but the wrapped large skip is still used to recompute valueSize for the backend call. 2. When the reconstructed valueSize exceeds the number of entries actually allocated in outResult, copyDataValues() writes beyond the end of the result array (heap-buffer-overflow write). Fix both issues in getHistoryData_service_default(): - Reject continuation points whose skip value exceeds the computed result set size, returning UA_STATUSCODE_BADCONTINUATIONPOINTINVALID. - After computing valueSize, cap it to the remaining allocated capacity in outResult so the backend cannot be instructed to write past the buffer. Internal Vulnerability Advisory: open62541-SA-2026-0027