Peter M. Groen / libmodbus

Commit e98fd68c3b74ecba39df862183a38bc392375cea

Authored by Michael Heimpold
Committed by Stéphane Raimbault
1 parent 97b3f176

modbus_send_raw_request: limit request length (fixes #207) 

Do not allow raw request length longer than the PDU size plus
the additional requested slave address byte.
Without this check modbus_send_raw_request could be used to
trigger a buffer overflow on the stack since the parameter
is passed unchecked to memcpy.

Thanks to Hanno Neuer for spotting this security flaw.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
Inline Side-by-side
Showing 1 changed file with 4 additions and 2 deletions
src/modbus.c
  View file @e98fd68
@@ -217,8 +217,10 @@ int modbus_send_raw_request(modbus_t *ctx, uint8_t *raw_req, int raw_req_length) @@ -217,8 +217,10 @@ int modbus_send_raw_request(modbus_t *ctx, uint8_t *raw_req, int raw_req_length)
217 return -1; 217 return -1;
218 } 218 }
219 219
220 - if (raw_req_length < 2) {  
221 - /* The raw request must contain function and slave at least */ 220 + if (raw_req_length < 2 || raw_req_length > (MODBUS_MAX_PDU_LENGTH + 1)) {
  221 + /* The raw request must contain function and slave at least and
  222 + must not be longer than the maximum pdu length plus the slave
  223 + address. */
222 errno = EINVAL; 224 errno = EINVAL;
223 return -1; 225 return -1;
224 } 226 }