瀏覽代碼

Fix stack buffer overflow

```
27: READ of size 4 at 0x7ffe44da68c1 thread T0
27:     #0 0x4eed2b in __asan_memcpy (/home/travis/build/open62541/open62541/build/bin/tests/check_pubsub_connection_udp+0x4eed2b)
27:     #1 0x553464 in UA_Array_copy /home/travis/build/open62541/open62541/src/ua_types.c:1067:9
27:     #2 0x55bf3b in Variant_copy /home/travis/build/open62541/open62541/src/ua_types.c:422:28
27:     #3 0x55938a in copy_noInit /home/travis/build/open62541/open62541/src/ua_types.c:934:23
27:     #4 0x552df5 in UA_copy /home/travis/build/open62541/open62541/src/ua_types.c:959:28
27:     #5 0x14a5d61 in UA_Variant_copy /home/travis/build/open62541/open62541/build/src_generated/ua_types_generated_handling.h:758:12
27:     #6 0x14a5c58 in UA_PubSubConnectionConfig_copy /home/travis/build/open62541/open62541/src/pubsub/ua_pubsub.c:50:23
27:     #7 0x14b5adb in UA_Server_addPubSubConnection /home/travis/build/open62541/open62541/src/pubsub/ua_pubsub_manager.c:44:28
27:     #8 0x52abc5 in AddSingleConnectionWithMaximalConfiguration /home/travis/build/open62541/open62541/tests/pubsub/check_pubsub_connection_udp.c:142:28
27:     #9 0x1615721 in tcase_run_tfun_nofork.isra.11 (/home/travis/build/open62541/open62541/build/bin/tests/check_pubsub_connection_udp+0x1615721)
27:     #10 0x161598d in srunner_run (/home/travis/build/open62541/open62541/build/bin/tests/check_pubsub_connection_udp+0x161598d)
27:     #11 0x5275de in main /home/travis/build/open62541/open62541/tests/pubsub/check_pubsub_connection_udp.c:216:5
27:     #12 0x2b442723ff44 in __libc_start_main /build/eglibc-ripdx6/eglibc-2.19/csu/libc-start.c:287
27:     #13 0x41af9b in _start (/home/travis/build/open62541/open62541/build/bin/tests/check_pubsub_connection_udp+0x41af9b)
```

See also https://travis-ci.org/open62541/open62541/jobs/474897811#L5964
Stefan Profanter 6 年之前
父節點
當前提交
ac0363d356
共有 1 個文件被更改,包括 4 次插入4 次删除
  1. 4 4
      tests/pubsub/check_pubsub_connection_udp.c

+ 4 - 4
tests/pubsub/check_pubsub_connection_udp.c

@@ -124,10 +124,10 @@ START_TEST(AddSingleConnectionWithMaximalConfiguration){
     UA_Variant_setScalar(&connectionOptions[0].value, &ttl, &UA_TYPES[UA_TYPES_UINT32]);
     connectionOptions[1].key = UA_QUALIFIEDNAME(0, "loopback");
     UA_Boolean loopback = UA_FALSE;
-    UA_Variant_setScalar(&connectionOptions[1].value, &loopback, &UA_TYPES[UA_TYPES_UINT32]);
+    UA_Variant_setScalar(&connectionOptions[1].value, &loopback, &UA_TYPES[UA_TYPES_BOOLEAN]);
     connectionOptions[2].key = UA_QUALIFIEDNAME(0, "reuse");
     UA_Boolean reuse = UA_TRUE;
-    UA_Variant_setScalar(&connectionOptions[2].value, &reuse, &UA_TYPES[UA_TYPES_UINT32]);
+    UA_Variant_setScalar(&connectionOptions[2].value, &reuse, &UA_TYPES[UA_TYPES_BOOLEAN]);
 
     UA_PubSubConnectionConfig connectionConf;
     memset(&connectionConf, 0, sizeof(UA_PubSubConnectionConfig));
@@ -155,10 +155,10 @@ START_TEST(GetMaximalConnectionConfigurationAndCompareValues){
     UA_Variant_setScalar(&connectionOptions[0].value, &ttl, &UA_TYPES[UA_TYPES_UINT32]);
     connectionOptions[1].key = UA_QUALIFIEDNAME(0, "loopback");
     UA_Boolean loopback = UA_FALSE;
-    UA_Variant_setScalar(&connectionOptions[1].value, &loopback, &UA_TYPES[UA_TYPES_UINT32]);
+    UA_Variant_setScalar(&connectionOptions[1].value, &loopback, &UA_TYPES[UA_TYPES_BOOLEAN]);
     connectionOptions[2].key = UA_QUALIFIEDNAME(0, "reuse");
     UA_Boolean reuse = UA_TRUE;
-    UA_Variant_setScalar(&connectionOptions[2].value, &reuse, &UA_TYPES[UA_TYPES_UINT32]);
+    UA_Variant_setScalar(&connectionOptions[2].value, &reuse, &UA_TYPES[UA_TYPES_BOOLEAN]);
 
     UA_PubSubConnectionConfig connectionConf;
     memset(&connectionConf, 0, sizeof(UA_PubSubConnectionConfig));