lib: parse_canframe: guard delimiter reads with length checks

As Alex J pointed out in comment
https://github.com/linux-can/can-utils/issues/632#issuecomment-5746692502
the delimiters to detect CAN CC/FD/XL frames were read from the input
data without checking the length of that input data. This could lead
to an out-of-bounds read and to unintended detection of incorrect content.

Add a length check before reading those delimiters and also add/change
some comments to clarify the reasons for some assignments.

Reported-by: Alex J <jipaionut@gmail.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>

.github/workflows/release-deb.yml

@@ -1,57 +0,0 @@
-name: Build Deb Package
-
-on:
-  release:
-    types: [created]
-
-permissions:
-  contents: write
-
-jobs:
-  build:
-    name: Build on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-24.04]
-
-    steps:
-    - name: Checkout source code
-      uses: actions/checkout@v6
-      with:
-        path: can-utils
-
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y build-essential devscripts debhelper cmake equivs
-
-        cd can-utils
-        # Install build dependencies defined in debian/control
-        sudo mk-build-deps -i -r -t "apt-get -y" debian/control
-
-    - name: Update changelog
-      run: |
-        cd can-utils
-        # Get version from tag, strip 'v' prefix if present
-        VERSION=${{ github.event.release.tag_name }}
-        VERSION=${VERSION#v}
-
-        # Add new entry to changelog
-        # Use the codename of the current OS (jammy or noble)
-        CODENAME=$(lsb_release -cs)
-
-        dch --create -v "${VERSION}-1~${CODENAME}" --package can-utils --distribution ${CODENAME} "New upstream release ${VERSION}"
-        dch -r ""
-
-    - name: Build package
-      run: |
-        cd can-utils
-        # Build binary packages only, unsigned
-        dpkg-buildpackage -us -uc -b
-
-    - name: Upload to Release
-      uses: softprops/action-gh-release@v2
-      with:
-        files: |
-          *.deb

debian/changelog

@@ -1,5 +0,0 @@
-can-utils (0.0.0-1) unstable; urgency=medium
-
-  * Initial release.
-
- -- Maintainer Name <maintainer@example.com>  Thu, 01 Jan 1970 00:00:00 +0000

debian/control

@@ -1,23 +0,0 @@
-Source: can-utils
-Section: net
-Priority: optional
-Maintainer: GitHub Actions <actions@github.com>
-Build-Depends: debhelper-compat (= 13), cmake
-Standards-Version: 4.6.2
-Homepage: https://github.com/linux-can/can-utils
-
-Package: can-utils
-Architecture: linux-any
-Depends: ${shlibs:Depends}, ${misc:Depends}
-Description: SocketCAN userspace utilities and tools
- This package contains some userspace utilities for Linux SocketCAN subsystem.
-
- Basic tools to display, record, generate and replay CAN traffic:
- candump, canplayer, cansend, cangen, cansniffer, cansequence.
- CAN access via IP sockets: canlogserver, bcmserver.
- CAN in-kernel gateway configuration: cangw.
- CAN bus measurement and testing: canbusload, can-calc-bit-timing, canfdtest, canerrsim.
- ISO-TP tools: isotpsend, isotprecv, isotpsniffer, isotpdump, isotpserver, isotptun.
- CAN log file converters: asc2log, log2asc, log2long.
- Serial Line Discipline configuration: slcan_attach, slcand, slcanpty.
- J1939 tools: j1939acd, j1939cat, j1939spy, j1939sr, testj1939.

debian/rules

@@ -1,3 +0,0 @@
-#!/usr/bin/make -f
-%:
-	dh $@

lib.c

@@ -170,21 +170,23 @@ int parse_canframe(char *cs, union cfu *cu)
 
 	memset(cu, 0, sizeof(*cu)); /* init CAN CC/FD/XL frame, e.g. LEN = 0 */
 
-	if (len < 4)
-		return 0;
+	if (len >= 4 && cs[3] == CANID_DELIM) { /* 3 digits SFF CAN ID */
 
-	if (cs[3] == CANID_DELIM) { /* 3 digits SFF */
+		idx = 4; /* start of frame data */
 
-		idx = 4;
+		/* get 3 digits SFF CAN ID value */
 		for (i = 0; i < 3; i++) {
 			if ((tmp = asc2nibble(cs[i])) > 0x0F)
 				return 0;
 			cu->cc.can_id |= tmp << (2 - i) * 4;
 		}
 
-	} else if (cs[5] == CANID_DELIM) { /* 5 digits CAN XL VCID/PRIO*/
+	} else if (len >= 21 && cs[5] == CANID_DELIM && cs[20] == CANID_DELIM) {
+		/* 5 digits CAN XL VCID/PRIO - but also check for 2nd '#' here */
 
-		idx = 6;
+		idx = 6; /* start of CAN XL frame extra content (AF, SDT, etc) */
+
+		/* get 5 digits CAN XL VCID/PRIO */
 		for (i = 0; i < 5; i++) {
 			if ((tmp = asc2nibble(cs[i])) > 0x0F)
 				return 0;
@@ -196,9 +198,11 @@ int parse_canframe(char *cs, union cfu *cu)
 		cu->xl.prio &= CANXL_PRIO_MASK;
 		cu->xl.prio |= tmp;
 
-	} else if (cs[8] == CANID_DELIM) { /* 8 digits EFF */
+	} else if (len >= 9 && cs[8] == CANID_DELIM) { /* 8 digits EFF CAN ID */
 
-		idx = 9;
+		idx = 9; /* start of frame data */
+
+		/* get 8 digits EFF CAN ID value */
 		for (i = 0; i < 8; i++) {
 			if ((tmp = asc2nibble(cs[i])) > 0x0F)
 				return 0;
@@ -239,11 +243,12 @@ int parse_canframe(char *cs, union cfu *cu)
 		cu->fd.flags |= CANFD_FDF; /* dual-use */
 		idx += 2;
 
-	} else if (cs[idx + 14] == CANID_DELIM) { /* CAN XL frame '#80:00:11223344#' */
+	} else if (idx == 6) { /* CAN XL frame extra content '#80:00:11223344#' */
 		maxdlen = CANXL_MAX_DLEN;
 		mtu = CANXL_MTU;
-		data = cu->xl.data; /* fill CAN XL data */
+		data = cu->xl.data; /* overwrite pointer to CAN XL data */
 
+		/* get CAN XL frame extra content */
 		if ((cs[idx + 2] != XL_HDR_DELIM) || (cs[idx + 5] != XL_HDR_DELIM))
 			return 0;
 
@@ -277,6 +282,7 @@ int parse_canframe(char *cs, union cfu *cu)
 		idx++; /* skip CANID_DELIM */
 	}
 
+	/* copy CAN frame data content */
 	for (i = 0, dlen = 0; i < maxdlen; i++) {
 		if (cs[idx] == DATA_SEPERATOR) /* skip (optional) separator */
 			idx++;