Browse Source

Fix stack-overflow when nested Variants are used

See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4233

Credit to oss-fuzz
Stefan Profanter 7 years ago
parent
commit
23131fe8ae
1 changed files with 4 additions and 2 deletions
  1. 4 2
      src/ua_types_encoding_binary.c

+ 4 - 2
src/ua_types_encoding_binary.c

@@ -1145,9 +1145,11 @@ Variant_decodeBinary(UA_Variant *dst, const UA_DataType *_) {
     const bool isArray = (encodingByte & UA_VARIANT_ENCODINGMASKTYPE_ARRAY) > 0;
 
     /* Get the datatype of the content. The type must be a builtin data type.
-     * All not-builtin types are wrapped in an ExtensionObject. */
+     * All not-builtin types are wrapped in an ExtensionObject.
+     * The content can not be a variant again, otherwise we may run into a stack overflow problem.
+     * See: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4233 */
     size_t typeIndex = (size_t)((encodingByte & UA_VARIANT_ENCODINGMASKTYPE_TYPEID_MASK) - 1);
-    if(typeIndex > UA_TYPES_DIAGNOSTICINFO)
+    if(typeIndex > UA_TYPES_DIAGNOSTICINFO || typeIndex == UA_TYPES_VARIANT)
         return UA_STATUSCODE_BADDECODINGERROR;
     dst->type = &UA_TYPES[typeIndex];