Merge pull request #49 from lategoodbye/master

Fix port and baudrate, add some checks

bin/mbus-serial-request-data-multi-reply.c

@@ -55,7 +55,8 @@ main(int argc, char **argv)
     mbus_handle *handle = NULL;
 
     char *device, *addr_str, *xml_result;
-    int address, baudrate = 9600;
+    int address;
+    long baudrate = 9600;
  
     memset((void *)&reply, 0, sizeof(mbus_frame));
     memset((void *)&reply_data, 0, sizeof(mbus_frame_data));
@@ -73,13 +74,13 @@ main(int argc, char **argv)
     }
     else if (argc == 5 && strcmp(argv[1], "-b") == 0)
     {
-        baudrate = atoi(argv[2]);
+        baudrate = atol(argv[2]);
         device   = argv[3];   
         addr_str = argv[4];
     }
     else if (argc == 6 && strcmp(argv[1], "-d") == 0 && strcmp(argv[2], "-b") == 0)
     {
-        baudrate = atoi(argv[3]);
+        baudrate = atol(argv[3]);
         device   = argv[4];   
         addr_str = argv[5];
         debug = 1;

bin/mbus-serial-request-data.c

@@ -26,7 +26,8 @@ main(int argc, char **argv)
     mbus_handle *handle = NULL;
 
     char *device, *addr_str, *xml_result;
-    int address, baudrate = 9600;
+    int address;
+    long baudrate = 9600;
     
     memset((void *)&reply, 0, sizeof(mbus_frame));
     memset((void *)&reply_data, 0, sizeof(mbus_frame_data));
@@ -44,13 +45,13 @@ main(int argc, char **argv)
     }
     else if (argc == 5 && strcmp(argv[1], "-b") == 0)
     {
-        baudrate = atoi(argv[2]);
+        baudrate = atol(argv[2]);
         device   = argv[3];   
         addr_str = argv[4];
     }
     else if (argc == 6 && strcmp(argv[1], "-d") == 0 && strcmp(argv[2], "-b") == 0)
     {
-        baudrate = atoi(argv[3]);
+        baudrate = atol(argv[3]);
         device   = argv[4];   
         addr_str = argv[5];
         debug = 1;

bin/mbus-serial-scan-secondary.c

@@ -52,7 +52,7 @@ int
 main(int argc, char **argv)
 {
     char *device, *addr_mask = NULL;
-    int baudrate = 9600;
+    long baudrate = 9600;
     mbus_handle *handle = NULL;
     mbus_frame *frame = NULL, reply;
     
@@ -82,26 +82,26 @@ main(int argc, char **argv)
     }
     else if (argc == 4 && strcmp(argv[1], "-b") == 0)
     {
-        baudrate = atoi(argv[2]);
+        baudrate = atol(argv[2]);
         device = argv[3];   
         addr_mask = strdup("FFFFFFFFFFFFFFFF");
     }
     else if (argc == 5 && strcmp(argv[1], "-d") == 0 && strcmp(argv[2], "-b") == 0)
     {
-        baudrate = atoi(argv[3]);
+        baudrate = atol(argv[3]);
         device = argv[4];   
         addr_mask = strdup("FFFFFFFFFFFFFFFF");
         debug = 1;
     }
     else if (argc == 5 && strcmp(argv[1], "-b") == 0)
     {
-        baudrate = atoi(argv[2]);
+        baudrate = atol(argv[2]);
         device = argv[3];   
         addr_mask = strdup(argv[4]);
     }
     else if (argc == 6 && strcmp(argv[1], "-d") == 0)
     {
-        baudrate = atoi(argv[3]);
+        baudrate = atol(argv[3]);
         device = argv[4];   
         addr_mask = strdup(argv[5]);
         debug = 1;

bin/mbus-serial-scan.c

@@ -54,7 +54,8 @@ main(int argc, char **argv)
 {
     mbus_handle *handle;
     char *device;
-    int address, baudrate = 9600, retries = 0;
+    int address, retries = 0;
+    long baudrate = 9600;
     int ret;
 
     if (argc == 2)
@@ -68,7 +69,7 @@ main(int argc, char **argv)
     }
     else if (argc == 4 && strcmp(argv[1], "-b") == 0)
     {
-        baudrate = atoi(argv[2]); 
+        baudrate = atol(argv[2]); 
         device = argv[3];
     }
     else if (argc == 4 && strcmp(argv[1], "-r") == 0)
@@ -79,7 +80,7 @@ main(int argc, char **argv)
     else if (argc == 5 && strcmp(argv[1], "-d") == 0 && strcmp(argv[2], "-b") == 0)
     {
         debug = 1;    
-        baudrate = atoi(argv[3]); 
+        baudrate = atol(argv[3]); 
         device = argv[4];
     }
     else if (argc == 5 && strcmp(argv[1], "-d") == 0 && strcmp(argv[2], "-r") == 0)
@@ -90,14 +91,14 @@ main(int argc, char **argv)
     }
     else if (argc == 6 && strcmp(argv[1], "-b") == 0 && strcmp(argv[3], "-r") == 0)
     {    
-        baudrate = atoi(argv[2]);
+        baudrate = atol(argv[2]);
         retries = atoi(argv[4]);
         device = argv[5];
     }
     else if (argc == 7 && strcmp(argv[1], "-d") == 0 && strcmp(argv[2], "-b") == 0 && strcmp(argv[4], "-r") == 0)
     {
         debug = 1;    
-        baudrate = atoi(argv[3]);
+        baudrate = atol(argv[3]);
         retries = atoi(argv[5]);
         device = argv[6];
     }

bin/mbus-serial-select-secondary.c

@@ -23,7 +23,8 @@ main(int argc, char **argv)
     mbus_handle *handle;
     mbus_frame reply;
     char *device, *addr = NULL;
-    int ret, baudrate = 9600;
+    int ret;
+    long baudrate = 9600;
 
     if (argc == 3)
     {
@@ -32,7 +33,7 @@ main(int argc, char **argv)
     }   
     else if (argc == 5 && strcmp(argv[1], "-b") == 0)
     {
-        baudrate = atoi(argv[2]);
+        baudrate = atol(argv[2]);
         device = argv[3];   
         addr = strdup(argv[4]);
     }

bin/mbus-serial-switch-baudrate.c

@@ -27,20 +27,20 @@ main(int argc, char **argv)
     mbus_frame reply;
     char *device;
     int address, ret;
-    int source_baudrate = 9600, target_baudrate;
+    long source_baudrate = 9600, target_baudrate;
 
     if (argc == 4)
     {
         device = argv[1];
         address = atoi(argv[2]);
-        target_baudrate = atoi(argv[3]);
+        target_baudrate = atol(argv[3]);
     }
     else if (argc == 6 && strcmp(argv[1], "-b") == 0)
     {
-        source_baudrate = atoi(argv[2]);
+        source_baudrate = atol(argv[2]);
         device = argv[3];
         address = atoi(argv[4]);
-        target_baudrate = atoi(argv[5]);
+        target_baudrate = atol(argv[5]);
     }
     else
     {

bin/mbus-tcp-raw-send.c

@@ -26,7 +26,8 @@ main(int argc, char **argv)
     mbus_handle *handle = NULL;
 
     char *host, *addr_str, matching_addr[16], *file = NULL;
-    int port, address, result;
+    long port;
+    int address, result;
     FILE *fp = NULL;
     size_t buff_len, len;
   	unsigned char raw_buff[4096], buff[4096];
@@ -37,21 +38,21 @@ main(int argc, char **argv)
     if (argc == 4)
     {
         host = argv[1];   
-        port = atoi(argv[2]);
+        port = atol(argv[2]);
         addr_str = argv[3];
         debug = 0;
     }
     else if (argc == 5 && strcmp(argv[1], "-d") == 0)
     {
         host = argv[2];   
-        port = atoi(argv[3]);
+        port = atol(argv[3]);
         addr_str = argv[4];
         debug = 1;
     }
     else if (argc == 5)
     {
         host = argv[1];   
-        port = atoi(argv[2]);
+        port = atol(argv[2]);
         addr_str = argv[3];
         file = argv[4];
         debug = 0;
@@ -59,7 +60,7 @@ main(int argc, char **argv)
     else if (argc == 6 && strcmp(argv[1], "-d") == 0)
     {
         host = argv[2];   
-        port = atoi(argv[3]);
+        port = atol(argv[3]);
         addr_str = argv[4];
         file = argv[5];
         debug = 1;
@@ -72,6 +73,12 @@ main(int argc, char **argv)
         return 0;
     }
     
+    if ((port < 0) || (port > 0xFFFF))
+    {
+        fprintf(stderr, "Invalid port: %ld\n", port);
+        return 1;
+    }
+    
     if (debug)
     {
         mbus_register_send_event(&mbus_dump_send_event);

bin/mbus-tcp-request-data-multi-reply.c

@@ -26,7 +26,8 @@ main(int argc, char **argv)
     mbus_handle *handle = NULL;
 
     char *host, *addr_str, matching_addr[16], *xml_result;
-    int port, address;
+    int address;
+    long port;
  
     memset((void *)&reply, 0, sizeof(mbus_frame));
     memset((void *)&reply_data, 0, sizeof(mbus_frame_data));
@@ -34,14 +35,14 @@ main(int argc, char **argv)
     if (argc == 4)
     {
         host = argv[1];   
-        port = atoi(argv[2]);
+        port = atol(argv[2]);
         addr_str = argv[3];
         debug = 0;
     }
     else if (argc == 5 && strcmp(argv[1], "-d") == 0)
     {
         host = argv[2];   
-        port = atoi(argv[3]);
+        port = atol(argv[3]);
         addr_str = argv[4];
         debug = 1;
     }
@@ -52,6 +53,12 @@ main(int argc, char **argv)
         return 0;
     }
     
+    if ((port < 0) || (port > 0xFFFF))
+    {
+        fprintf(stderr, "Invalid port: %ld\n", port);
+        return 1;
+    }
+    
     if (debug)
     {
         mbus_register_send_event(&mbus_dump_send_event);

bin/mbus-tcp-request-data.c

@@ -26,7 +26,8 @@ main(int argc, char **argv)
     mbus_handle *handle = NULL;
 
     char *host, *addr_str, matching_addr[16], *xml_result;
-    int port, address;
+    int address;
+    long port;
  
     memset((void *)&reply, 0, sizeof(mbus_frame));
     memset((void *)&reply_data, 0, sizeof(mbus_frame_data));
@@ -34,14 +35,14 @@ main(int argc, char **argv)
     if (argc == 4)
     {
         host = argv[1];   
-        port = atoi(argv[2]);
+        port = atol(argv[2]);
         addr_str = argv[3];
         debug = 0;
     }
     else if (argc == 5 && strcmp(argv[1], "-d") == 0)
     {
         host = argv[2];   
-        port = atoi(argv[3]);
+        port = atol(argv[3]);
         addr_str = argv[4];
         debug = 1;
     }
@@ -52,6 +53,12 @@ main(int argc, char **argv)
         return 0;
     }
     
+    if ((port < 0) || (port > 0xFFFF))
+    {
+        fprintf(stderr, "Invalid port: %ld\n", port);
+        return 1;
+    }
+    
     if (debug)
     {
         mbus_register_send_event(&mbus_dump_send_event);

bin/mbus-tcp-scan-secondary.c

@@ -22,7 +22,7 @@ int
 main(int argc, char **argv)
 {
     char *host, *addr_mask = NULL;
-    int port;
+    long port;
     mbus_handle *handle = NULL;
     mbus_frame *frame = NULL, reply;
     
@@ -37,7 +37,7 @@ main(int argc, char **argv)
     }
  
     host = argv[1];   
-    port = atoi(argv[2]);
+    port = atol(argv[2]);
     if (argc == 4)
     {
         addr_mask = strdup(argv[3]);
@@ -53,6 +53,12 @@ main(int argc, char **argv)
         return 1;
     }
     
+    if ((port < 0) || (port > 0xFFFF))
+    {
+        fprintf(stderr, "Invalid port: %ld\n", port);
+        return 1;
+    }
+
     if (mbus_is_secondary_address(addr_mask) == 0)
     {
         fprintf(stderr, "Misformatted secondary address mask. Must be 16 character HEX number.\n");

bin/mbus-tcp-scan.c

@@ -54,32 +54,33 @@ main(int argc, char **argv)
 {
     mbus_handle *handle;
     char *host;
-    int port, address, retries = 0;
+    int address, retries = 0;
+    long port;
     int ret;
 
     if (argc == 3)
     {
         host = argv[1];   
-        port = atoi(argv[2]);
+        port = atol(argv[2]);
     }
     else if (argc == 4 && strcmp(argv[1], "-d") == 0)
     {
         debug = 1;
         host = argv[2];   
-        port = atoi(argv[3]);
+        port = atol(argv[3]);
     }
     else if (argc == 5 && strcmp(argv[1], "-r") == 0)
     {
         retries = atoi(argv[2]); 
         host = argv[3];   
-        port = atoi(argv[4]);
+        port = atol(argv[4]);
     }
     else if (argc == 6 && strcmp(argv[1], "-d") == 0 && strcmp(argv[2], "-r") == 0)
     {
         debug = 1;
         retries = atoi(argv[3]); 
         host = argv[4];   
-        port = atoi(argv[5]);
+        port = atol(argv[5]);
     }
     else
     {
@@ -87,6 +88,12 @@ main(int argc, char **argv)
         return 0;
     }
     
+    if ((port < 0) || (port > 0xFFFF))
+    {
+        fprintf(stderr, "Invalid port: %ld\n", port);
+        return 1;
+    }
+    
     if (debug)
     {
         mbus_register_send_event(&mbus_dump_send_event);

bin/mbus-tcp-select-secondary.c

@@ -23,7 +23,8 @@ main(int argc, char **argv)
     mbus_handle *handle;
     mbus_frame reply;
     char *host, *addr = NULL;
-    int port, ret;
+    int ret;
+    long port;
 
     if (argc != 4)
     {
@@ -32,7 +33,13 @@ main(int argc, char **argv)
     }
  
     host = argv[1];   
-    port = atoi(argv[2]);
+    port = atol(argv[2]);
+    
+    if ((port < 0) || (port > 0xFFFF))
+    {
+        fprintf(stderr, "Invalid port: %ld\n", port);
+        return 1;
+    }
     
     if ((addr = strdup(argv[3])) == NULL)
     {

mbus/mbus-protocol-aux.c

@@ -1438,7 +1438,7 @@ mbus_context_serial(const char *device)
 }
 
 mbus_handle *
-mbus_context_tcp(const char *host, int port)
+mbus_context_tcp(const char *host, uint16_t port)
 {
     mbus_handle *handle;
     mbus_tcp_data *tcp_data;
@@ -1655,7 +1655,7 @@ mbus_send_select_frame(mbus_handle * handle, const char *secondary_addr_str)
 // adressed slave(s) switch to the given baudrate
 //------------------------------------------------------------------------------
 int
-mbus_send_switch_baudrate_frame(mbus_handle * handle, int address, int baudrate)
+mbus_send_switch_baudrate_frame(mbus_handle * handle, int address, long baudrate)
 {
     int retval = 0;
     int control_information = 0;

mbus/mbus-protocol-aux.h

@@ -177,7 +177,7 @@ mbus_handle * mbus_context_serial(const char *device);
  * 
  * @return Initialized "unified" handler when successful, NULL otherwise;
  */
-mbus_handle * mbus_context_tcp(const char *host, int port);
+mbus_handle * mbus_context_tcp(const char *host, uint16_t port);
 
 /** 
  * Deallocate memory used by M-Bus context.
@@ -275,7 +275,7 @@ int mbus_send_application_reset_frame(mbus_handle * handle, int address, int sub
  * 
  * @return Zero when successful.
  */
-int mbus_send_switch_baudrate_frame(mbus_handle * handle, int address, int baudrate);
+int mbus_send_switch_baudrate_frame(mbus_handle * handle, int address, long baudrate);
 
 /** 
  * Sends request frame (REQ_UD2) to given slave using "unified" handle

mbus/mbus-protocol.h

@@ -19,6 +19,7 @@
 #define _MBUS_PROTOCOL_H_
 
 #include <stdlib.h>
+#include <stdint.h>
 #include <time.h>
 
 #ifdef __cplusplus

mbus/mbus-serial.c

@@ -9,6 +9,7 @@
 //------------------------------------------------------------------------------
 
 #include <unistd.h>
+#include <limits.h>
 #include <fcntl.h>
 
 #include <sys/types.h>
@@ -61,7 +62,7 @@ mbus_serial_connect(mbus_handle *handle)
     term->c_cflag |= PARENB;
 
     // No received data still OK
-    term->c_cc[VMIN]  = 0;
+    term->c_cc[VMIN] = (cc_t) 0;
 
     // Wait at most 0.2 sec.Note that it starts after first received byte!!
     // I.e. if CMIN>0 and there are no data we would still wait forever...
@@ -74,7 +75,7 @@ mbus_serial_connect(mbus_handle *handle)
     // For 2400Bd this means (330 + 11) / 2400 + 0.05 = 188.75 ms (added 11 bit periods to receive first byte).
     // I.e. timeout of 0.2s seems appropriate for 2400Bd.
 
-    term->c_cc[VTIME] = 2; // Timeout in 1/10 sec
+    term->c_cc[VTIME] = (cc_t) 2; // Timeout in 1/10 sec
 
     cfsetispeed(term, B2400);
     cfsetospeed(term, B2400);
@@ -95,7 +96,7 @@ mbus_serial_connect(mbus_handle *handle)
 // Set baud rate for serial connection
 //------------------------------------------------------------------------------
 int
-mbus_serial_set_baudrate(mbus_handle *handle, int baudrate)
+mbus_serial_set_baudrate(mbus_handle *handle, long baudrate)
 {
     speed_t speed;
     mbus_serial_data *serial_data;
@@ -105,46 +106,49 @@ mbus_serial_set_baudrate(mbus_handle *handle, int baudrate)
 
     serial_data = (mbus_serial_data *) handle->auxdata;
     
+    if (serial_data == NULL)
+        return -1;
+
     switch (baudrate)
     {
         case 300:
             speed = B300;
-            serial_data->t.c_cc[VTIME] = 12; // Timeout in 1/10 sec
+            serial_data->t.c_cc[VTIME] = (cc_t) 12; // Timeout in 1/10 sec
             break;
 
         case 600:
             speed = B600;
-            serial_data->t.c_cc[VTIME] = 6;  // Timeout in 1/10 sec
+            serial_data->t.c_cc[VTIME] = (cc_t) 6;  // Timeout in 1/10 sec
             break;
 
         case 1200:
             speed = B1200;
-            serial_data->t.c_cc[VTIME] = 4;  // Timeout in 1/10 sec
+            serial_data->t.c_cc[VTIME] = (cc_t) 4;  // Timeout in 1/10 sec
             break;
 
         case 2400:
             speed = B2400;
-            serial_data->t.c_cc[VTIME] = 2;  // Timeout in 1/10 sec
+            serial_data->t.c_cc[VTIME] = (cc_t) 2;  // Timeout in 1/10 sec
             break;
 
         case 4800:
             speed = B4800;
-            serial_data->t.c_cc[VTIME] = 2;  // Timeout in 1/10 sec
+            serial_data->t.c_cc[VTIME] = (cc_t) 2;  // Timeout in 1/10 sec
             break;
 
         case 9600:
             speed = B9600;
-            serial_data->t.c_cc[VTIME] = 1;  // Timeout in 1/10 sec
+            serial_data->t.c_cc[VTIME] = (cc_t) 1;  // Timeout in 1/10 sec
             break;
 
         case 19200:
             speed = B19200;
-            serial_data->t.c_cc[VTIME] = 1;  // Timeout in 1/10 sec
+            serial_data->t.c_cc[VTIME] = (cc_t) 1;  // Timeout in 1/10 sec
             break;
 
         case 38400:
             speed = B38400;
-            serial_data->t.c_cc[VTIME] = 1;  // Timeout in 1/10 sec
+            serial_data->t.c_cc[VTIME] = (cc_t) 1;  // Timeout in 1/10 sec
             break;
 
        default:
@@ -197,8 +201,15 @@ mbus_serial_data_free(mbus_handle *handle)
     if (handle)
     {
         serial_data = (mbus_serial_data *) handle->auxdata;
+        
+        if (serial_data == NULL)
+        {
+            return;
+        }
+        
         free(serial_data->device);
         free(serial_data);
+        handle->auxdata = NULL;
     }
 }
 
@@ -216,6 +227,12 @@ mbus_serial_send_frame(mbus_handle *handle, mbus_frame *frame)
         return -1;
     }
     
+    // Make sure serial connection is open
+    if (isatty(handle->fd) == 0)
+    {
+        return -1;
+    }
+
     if ((len = mbus_frame_pack(frame, buff, sizeof(buff))) == -1)
     {
         fprintf(stderr, "%s: mbus_frame_pack failed\n", __PRETTY_FUNCTION__);
@@ -262,7 +279,8 @@ int
 mbus_serial_recv_frame(mbus_handle *handle, mbus_frame *frame)
 {
     char buff[PACKET_BUFF_SIZE];
-    int len, remaining, nread, timeouts;
+    int remaining, timeouts;
+    ssize_t len, nread;
     
     if (handle == NULL || frame == NULL)
     {
@@ -270,6 +288,13 @@ mbus_serial_recv_frame(mbus_handle *handle, mbus_frame *frame)
         return MBUS_RECV_RESULT_ERROR;
     }
     
+    // Make sure serial connection is open
+    if (isatty(handle->fd) == 0)
+    {
+        fprintf(stderr, "%s: Serial connection is not available.\n", __PRETTY_FUNCTION__);
+        return MBUS_RECV_RESULT_ERROR;
+    }
+
     memset((void *)buff, 0, sizeof(buff));
 
     //
@@ -280,6 +305,12 @@ mbus_serial_recv_frame(mbus_handle *handle, mbus_frame *frame)
     timeouts = 0;
 
     do {
+        if (len + remaining > PACKET_BUFF_SIZE)
+        {
+            // avoid out of bounds access
+            return MBUS_RECV_RESULT_ERROR;
+        }
+        
         //printf("%s: Attempt to read %d bytes [len = %d]\n", __PRETTY_FUNCTION__, remaining, len);
 
         if ((nread = read(handle->fd, &buff[len], remaining)) == -1)
@@ -303,6 +334,12 @@ mbus_serial_recv_frame(mbus_handle *handle, mbus_frame *frame)
             }
         }
         
+        if (len > (SSIZE_MAX-nread))
+        {
+            // avoid overflow
+            return MBUS_RECV_RESULT_ERROR;
+        }
+
         len += nread;
 
     } while ((remaining = mbus_parse(frame, buff, len)) > 0);

mbus/mbus-serial.h

@@ -37,7 +37,7 @@ int                 mbus_serial_connect(mbus_handle *handle);
 int                 mbus_serial_disconnect(mbus_handle *handle);
 int                 mbus_serial_send_frame(mbus_handle *handle, mbus_frame *frame);
 int                 mbus_serial_recv_frame(mbus_handle *handle, mbus_frame *frame);
-int                 mbus_serial_set_baudrate(mbus_handle *handle, int baudrate);
+int                 mbus_serial_set_baudrate(mbus_handle *handle, long baudrate);
 void                mbus_serial_data_free(mbus_handle *handle);
 
 #ifdef __cplusplus

mbus/mbus-tcp.c

@@ -9,6 +9,7 @@
 //------------------------------------------------------------------------------
 
 #include <unistd.h>
+#include <limits.h>
 #include <fcntl.h>
 
 #include <sys/socket.h>
@@ -38,7 +39,7 @@ mbus_tcp_connect(mbus_handle *handle)
     struct sockaddr_in s;
     struct timeval time_out;
     mbus_tcp_data *tcp_data;
-    int port;
+    uint16_t port;
 
     if (handle == NULL)
         return -1;
@@ -97,8 +98,15 @@ mbus_tcp_data_free(mbus_handle *handle)
     if (handle)
     {
         tcp_data = (mbus_tcp_data *) handle->auxdata;
+        
+        if (tcp_data == NULL)
+        {
+            return;
+        }
+        
         free(tcp_data->host);
         free(tcp_data);
+        handle->auxdata = NULL;
     }
 }
 
@@ -126,6 +134,7 @@ mbus_tcp_send_frame(mbus_handle *handle, mbus_frame *frame)
 {
     unsigned char buff[PACKET_BUFF_SIZE];
     int len, ret;
+    char error_str[128];
 
     if (handle == NULL || frame == NULL)
     {
@@ -134,7 +143,6 @@ mbus_tcp_send_frame(mbus_handle *handle, mbus_frame *frame)
 
     if ((len = mbus_frame_pack(frame, buff, sizeof(buff))) == -1)
     {
-        char error_str[128];
         snprintf(error_str, sizeof(error_str), "%s: mbus_frame_pack failed\n", __PRETTY_FUNCTION__);
         mbus_error_str_set(error_str);
         return -1;
@@ -150,7 +158,6 @@ mbus_tcp_send_frame(mbus_handle *handle, mbus_frame *frame)
     }
     else
     {   
-        char error_str[128];
         snprintf(error_str, sizeof(error_str), "%s: Failed to write frame to socket (ret = %d)\n", __PRETTY_FUNCTION__, ret);
         mbus_error_str_set(error_str);
         return -1;
@@ -165,7 +172,8 @@ mbus_tcp_send_frame(mbus_handle *handle, mbus_frame *frame)
 int mbus_tcp_recv_frame(mbus_handle *handle, mbus_frame *frame)
 {
     char buff[PACKET_BUFF_SIZE];
-    int len, remaining, nread;
+    int remaining;
+    ssize_t len, nread;
 
     if (handle == NULL || frame == NULL) {
         fprintf(stderr, "%s: Invalid parameter.\n", __PRETTY_FUNCTION__);
@@ -182,6 +190,12 @@ int mbus_tcp_recv_frame(mbus_handle *handle, mbus_frame *frame)
 
     do {
 retry:
+        if (len + remaining > PACKET_BUFF_SIZE)
+        {
+            // avoid out of bounds access
+            return MBUS_RECV_RESULT_ERROR;
+        }
+
         nread = read(handle->fd, &buff[len], remaining);
         switch (nread) {
         case -1:
@@ -199,6 +213,12 @@ retry:
             mbus_error_str_set("M-Bus tcp transport layer connection closed by remote host.");
             return MBUS_RECV_RESULT_RESET;
         default:
+            if (len > (SSIZE_MAX-nread))
+            {
+                // avoid overflow
+                return MBUS_RECV_RESULT_ERROR;
+            }
+        
             len += nread;
         }
     } while ((remaining = mbus_parse(frame, buff, len)) > 0);

mbus/mbus-tcp.h

@@ -29,7 +29,7 @@ extern "C" {
 typedef struct _mbus_tcp_data
 {
     char *host;
-    int port;
+    uint16_t port;
 } mbus_tcp_data;
 
 int              mbus_tcp_connect(mbus_handle *handle);