From 9605d8dce8c9475c501f5298d3b205cb5842cb39 Mon Sep 17 00:00:00 2001 From: Ramon Roche Date: Thu, 12 Mar 2026 21:12:55 -0700 Subject: [PATCH] fix(tattu_can): validate CAN frame bounds before buffer copy Add bounds checking in the CAN frame assembly loop to prevent a buffer overflow when copying payloads into the Tattu12SBatteryMessage struct. A crafted CAN frame with a corrupt payload_size could write past the 48-byte struct boundary. Also guard against payload_size of 0 which would cause an unsigned integer underflow on the size_t subtraction. Fixes GHSA-wxwm-xmx9-hr32 Signed-off-by: Ramon Roche --- src/drivers/tattu_can/TattuCan.cpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/drivers/tattu_can/TattuCan.cpp b/src/drivers/tattu_can/TattuCan.cpp index 1f414c0907..ef10e09c00 100644 --- a/src/drivers/tattu_can/TattuCan.cpp +++ b/src/drivers/tattu_can/TattuCan.cpp @@ -96,9 +96,16 @@ void TattuCan::Run() while (receive(&received_frame) > 0) { + if (received_frame.payload_size == 0) { + break; + } + size_t payload_size = received_frame.payload_size - 1; - // TODO: add check to prevent buffer overflow from a corrupt 'payload_size' value - // TODO: AND look for TAIL_BYTE_START_OF_TRANSFER to indicate end of transfer. Untested... + + if (offset + payload_size > sizeof(tattu_message)) { + break; + } + memcpy(((char *)&tattu_message) + offset, received_frame.payload, payload_size); offset += payload_size; }