sven/can-utils
1
0
Fork 0
mirror of https://github.com/linux-can/can-utils.git synced 2026-11-04 07:21:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

j1939acd: check length and address of Commanded Address messages

Browse Source 
The Commanded Address message contains the 8 byte NAME and the new
source address. The received length was not checked, so the new source
address was taken from stale or uninitialized content of the receive
buffer for short messages. Also the idle and global addresses were
passed to claim_address() which terminates the daemon when bind() fails.

Check for the complete message length and only accept unicast addresses.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
This commit is contained in:
Oliver Hartkopp
2026-10-14 10:21:56 +00:00
parent 13dc8e9cc5
commit 1a90b9a75d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
j1939acd.c
+6
View File
@@ -618,6 +618,12 @@ int main(int argc, char *argv[])
}
break;
case J1939_PGN_ADDRESS_COMMANDED:
/* 8 bytes NAME + 1 byte new source address */
if (ret < 9)
break;
/* only accept valid unicast addresses */
if (dat[8] > J1939_MAX_UNICAST_ADDR)
break;
if (!host_is_little_endian())
bswap(dat, 8);
memcpy(&cmd_name, dat, 8);