Repository navigation
Fix vulnerabilities reported in October 2026 - #243
Merged
Merged
Conversation
Collaborator
Author
|
@johvik Maybe you want to take a look at it before I merge? |
Contributor
|
Sure, I can take a look some day next week
|
lategoodbye
force-pushed
the
bugfixes
branch
2 times, most recently
from
October 18, 2026 12:17
42e881f to
b85ee39
Compare
johvik
reviewed
Oct 19, 2026
johvik
left a comment
johvik
left a comment
Contributor
There was a problem hiding this comment.
@lategoodbye I think it looks pretty good overall, have two concerns/questions in mbus_data_variable_parse() and some other minor thoughts/ideas
Collaborator
Author
I think all your comments should be addressed now |
johvik
reviewed
Oct 20, 2026
johvik
left a comment
johvik
left a comment
Contributor
There was a problem hiding this comment.
One last thing, looks good to me apart from that 👍
Comment on lines
+4020
to
+4025
| if (i >= frame->data_size) | ||
| { | ||
| mbus_data_record_free(record); | ||
| snprintf(error_str, sizeof(error_str), "Premature end of record at LVAR."); | ||
| return -1; | ||
| } |
Contributor
There was a problem hiding this comment.
this one is missing mbus_data_record_free(data->record); data->record = NULL;
Collaborator
Author
There was a problem hiding this comment.
Oh dear, thanks
Issues has been found with Codex
At two places in mbus_data_variable_parse were no proper bounds checks, which could result in a one-byte out-of-bounds reads. Thanks to Tony Gair for reporting.
Issues has been found with Codex
In error cases the function leaked memory of the successful parsed M-Bus data records. Thanks to Lee Pike for reporting.
Some function assume ndife & nvife always to be in a valid range. So avoid a possible out of bounds access. Issue has been found with Codex
Huge M-Bus frames are not properly handled by mbus_frame_print, which could result in dump of uninitialized memory.
Thanks to johvik for reporting
These helper functions can overflow for big BCD numbers, but weren't intended for external use. So limit it to the libmbus use case. While at this fix an off-by-one in mbus_data_bcd_decode. Thanks to Tony Gair for reporting.
After freeing the records of the last frame the pointer should be set to NULL. Otherwise this could result in a double-free. Issue has been found with Codex
In case mbus_parse_variable_record fails to normalize the unit, the allocate string should also be freed.
The shift calculation doesn't properly handle big storage numbers. Since datatype long isn't capable to store the maximum on all platforms, this should also be handled as an error. Thanks to Lee Pike and Tony Gair for reporting.
Some functions assume data_len always to be in a valid range. So avoid a possible out of bounds access. Issue has been found with Codex
Issue has been found with Codex
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request fix the following vulnerabilities for this month:
Thanks to Lee Pike & Tony Gair & johvik for reporting.