Ramon Roche 3f04b7a95a fix(tattu_can): validate CAN frame bounds before buffer copy
Add bounds checking in the CAN frame assembly loop to prevent a buffer
overflow when copying payloads into the Tattu12SBatteryMessage struct.
A crafted CAN frame with a corrupt payload_size could write past the
48-byte struct boundary. Also guard against payload_size of 0 which
would cause an unsigned integer underflow on the size_t subtraction.

Fixes GHSA-wxwm-xmx9-hr32

Signed-off-by: Ramon Roche <mrpollo@gmail.com>
2026-03-13 09:16:01 -07:00
..
2026-03-11 19:50:52 +01:00
2025-03-10 18:59:52 -04:00
2024-12-19 07:30:25 +01:00