From 5ccdf5ef79d742640355d1132fa9e2abc7fbaefc Mon Sep 17 00:00:00 2001 From: Stéphane Raimbault Date: Fri, 26 Jul 2019 16:00:06 +0200 Subject: [PATCH] Fix VD-1301 and VD-1302 vulnerabilities --- src/modbus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/modbus.c b/src/modbus.c index 03d8da2..9bb5052 100644 --- a/src/modbus.c +++ b/src/modbus.c @@ -839,9 +839,10 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req, break; case MODBUS_FC_WRITE_MULTIPLE_COILS: { int nb = (req[offset + 3] << 8) + req[offset + 4]; + int nb_bits = req[offset + 5]; int mapping_address = address - mb_mapping->start_bits; - if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) { + if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) { /* May be the indication has been truncated on reading because of * invalid address (eg. nb is 0 but the request contains values to * write) so it's necessary to flush. */ @@ -870,9 +871,10 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req, break; case MODBUS_FC_WRITE_MULTIPLE_REGISTERS: { int nb = (req[offset + 3] << 8) + req[offset + 4]; + int nb_bytes = req[offset + 5]; int mapping_address = address - mb_mapping->start_registers; - if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) { + if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) { rsp_length = response_exception( ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE, "Illegal number of values %d in write_registers (max %d)\n", -- libgit2 0.21.4