From 1a90b9a75de72150e5c33f45186b2fd9ab7fd4b6 Mon Sep 17 00:00:00 2001 From: Oliver Hartkopp Date: Wed, 14 Oct 2026 09:59:26 +0000 Subject: [PATCH] j1939acd: check length and address of Commanded Address messages The Commanded Address message contains the 8 byte NAME and the new source address. The received length was not checked, so the new source address was taken from stale or uninitialized content of the receive buffer for short messages. Also the idle and global addresses were passed to claim_address() which terminates the daemon when bind() fails. Check for the complete message length and only accept unicast addresses. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Oliver Hartkopp --- j1939acd.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/j1939acd.c b/j1939acd.c index a3f4ad1..7b09e76 100644 --- a/j1939acd.c +++ b/j1939acd.c @@ -618,6 +618,12 @@ int main(int argc, char *argv[]) } break; case J1939_PGN_ADDRESS_COMMANDED: + /* 8 bytes NAME + 1 byte new source address */ + if (ret < 9) + break; + /* only accept valid unicast addresses */ + if (dat[8] > J1939_MAX_UNICAST_ADDR) + break; if (!host_is_little_endian()) bswap(dat, 8); memcpy(&cmd_name, dat, 8);