Skip to content

Fix network control handler to ensure proper offset calculation and prevent buffer overrun - #1387

Merged
skarg merged 8 commits into
masterfrom
bugfix/router-mstp-ipv6-demo-app-out-of-bounds-read
Jun 16, 2026
Merged

Fix network control handler to ensure proper offset calculation and prevent buffer overrun#1387
skarg merged 8 commits into
masterfrom
bugfix/router-mstp-ipv6-demo-app-out-of-bounds-read

Conversation

@skarg

@skarg skarg commented Jun 13, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the router demo applications’ network_control_handler() parsing of NETWORK_MESSAGE_INIT_RT_TABLE to correctly maintain the running offset while iterating a received routing table list, aiming to avoid incorrect offset resets and reduce risk of out-of-bounds access during NPDU parsing.

Changes:

  • Move the i offset initialization outside the per-entry loop so it advances across entries instead of resetting each iteration.
  • Simplify entry skipping to i += 4 + PortInfoLen and add a minimal header-length guard before decoding fields.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
apps/router-mstp/main.c Fixes INIT-RT-TABLE list parsing offset handling and adds a basic minimum-length check.
apps/router-ipv6/main.c Applies the same INIT-RT-TABLE list parsing offset fix and basic minimum-length check.

Comment thread apps/router-mstp/main.c Outdated
Comment thread apps/router-ipv6/main.c Outdated

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

Comment thread src/bacnet/npdu.c
Comment thread src/bacnet/npdu.c
Comment thread src/bacnet/npdu.c Outdated
Comment thread src/bacnet/npdu.h
Comment thread src/bacnet/npdu.h
Comment thread src/bacnet/npdu.c
Comment thread src/bacnet/npdu.c
skarg and others added 2 commits June 16, 2026 10:12
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…NPDU data. Fix npdu_init_routing_table_process() overrun.
@skarg
skarg merged commit 4ed32fc into master Jun 16, 2026
36 checks passed
@skarg
skarg deleted the bugfix/router-mstp-ipv6-demo-app-out-of-bounds-read branch June 16, 2026 15:33
skarg added a commit that referenced this pull request Jun 26, 2026
…revent buffer overrun (#1387)

* Fix out-of-bounds read in network control handler by validating NPDU length and adjusting offsets

* Refactor network control handler to use dedicated processing functions for I-Am-Router and Init Routing Table messages, improving code clarity and maintainability.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants