Browse Source

Check recursion limit for DiagnosticInfo containing DiagnosticInfo

See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5835

Credit to oss-fuzz
Stefan Profanter 6 years ago
parent
commit
805bd9864f
1 changed files with 8 additions and 0 deletions
  1. 8 0
      src/ua_types_encoding_binary.c

+ 8 - 0
src/ua_types_encoding_binary.c

@@ -1324,8 +1324,16 @@ DECODE_BINARY(DiagnosticInfo) {
             UA_calloc(1, sizeof(UA_DiagnosticInfo));
         if(!dst->innerDiagnosticInfo)
             return UA_STATUSCODE_BADOUTOFMEMORY;
+
+        /* Check the recursion limit */
+        if(ctx->depth > UA_ENCODING_MAX_RECURSION)
+            return UA_STATUSCODE_BADENCODINGERROR;
+        ctx->depth++;
+
         dst->hasInnerDiagnosticInfo = true;
         ret |= DECODE_DIRECT(dst->innerDiagnosticInfo, DiagnosticInfo);
+
+        ctx->depth--;
     }
     return ret;
 }