Peter M. Groen / libmodbus

Commit 9b4212c892d468fb87e270105d3a3b4c24da89a3

Authored by Stéphane Raimbault
1 parent b7894da5

modbus_mask_write_register: better fix with unit test (closes #265)

Inline Side-by-side
Showing 3 changed files with 20 additions and 1 deletions
  1 +libmodbus 3.2.0 (XXXX-XX-XX)
  2 +============================
  3 +
  4 +- Fix buffer overflow in modbus_mask_write_register #265)
  5 +
  6 +
1 7 libmodbus 3.1.2 (2015-02-13)
2 8 ============================
3 9  
... ...
src/modbus.c
  View file @9b4212c
... ... @@ -1458,7 +1458,10 @@ int modbus_mask_write_register(modbus_t *ctx, int addr, uint16_t and_mask, uint1
1458 1458 {
1459 1459 int rc;
1460 1460 int req_length;
1461   - uint8_t req[MAX_MESSAGE_LENGTH];
  1461 + /* The request length can not exceed _MIN_REQ_LENGTH - 2 and 4 bytes to
  1462 + * store the masks. The ugly substraction is there to remove the 'nb' value
  1463 + * (2 bytes) which is not used. */
  1464 + uint8_t req[_MIN_REQ_LENGTH + 2];
1462 1465  
1463 1466 req_length = ctx->backend->build_request_basis(ctx,
1464 1467 MODBUS_FC_MASK_WRITE_REGISTER,
... ...
tests/unit-test-client.c
  View file @9b4212c
... ... @@ -299,6 +299,16 @@ int main(int argc, char *argv[])
299 299 real = modbus_get_float_dcba(tab_rp_registers);
300 300 ASSERT_TRUE(real == UT_REAL, "FAILED (%f != %f)\n", real, UT_REAL);
301 301  
  302 + /* MASKS */
  303 + printf("1/1 Write mask: ");
  304 + rc = modbus_write_register(ctx, UT_REGISTERS_ADDRESS, 0x12);
  305 + rc = modbus_mask_write_register(ctx, UT_REGISTERS_ADDRESS, 0xF2, 0x25);
  306 + ASSERT_TRUE(rc != -1, "FAILED (%x == -1)\n", rc);
  307 + rc = modbus_read_registers(ctx, UT_REGISTERS_ADDRESS, 1, tab_rp_registers);
  308 + ASSERT_TRUE(tab_rp_registers[0] == 0x17,
  309 + "FAILED (%0X != %0X)\n",
  310 + tab_rp_registers[0], 0x17);
  311 +
302 312 printf("\nAt this point, error messages doesn't mean the test has failed\n");
303 313  
304 314 /** ILLEGAL DATA ADDRESS **/
... ...