Fix segmentation fault

- check if L Field is at least 3 to avoid crash (MBDOC48.PDF, page 23)
2012-12-22 00:08:59 +01:00 · 2012-12-22 00:08:59 +01:00 · 2335deb742
commit 2335deb742
parent 1080031879
1 changed files with 8 additions and 0 deletions
--- a/mbus/mbus-protocol.c
+++ b/mbus/mbus-protocol.c
@ -2554,6 +2554,14 @@ mbus_parse(mbus_frame *frame, u_char *data, size_t data_size)
                frame->length1  = data[1];
                frame->length2  = data[2];
                
+                if (frame->length1 < 3)
+                {
+                    snprintf(error_str, sizeof(error_str), "Invalid M-Bus frame length.");
+                
+                    // not a valid M-bus frame
+                    return -2;
+                }
+                
                if (frame->length1 != frame->length2)
                {
                    snprintf(error_str, sizeof(error_str), "Invalid M-Bus frame length.");