STM-PLC bug8

[SDawn.1]

URL:

https://www.st.com/content/st_com/en/products/embedded-software/mcu-mpu-embedded-software/stm32-embedded-software/stm32-ode-function-pack-sw/fp-ind-plcwifi1.html

Type: 

Buffer overflow

Description:

The variable component_index is used as an index for accessing the array Component and will increase with many operations for example the code snippet as shown in line 337 of Ladder_Lib.c. It may lead to a buffer overflow without checking the availability of the index component_index when accessing the array Component as shown in line 421 of Ladder_Lib.c.

108

uint8_t Component[512];

...

236

int16_t WiFi_Decode (uint8_t* frame) 

237

{

...

337

Component[component_index++]=decode;

...

421

Component[component_index]='#';

...

429

}

Result: Memory corruption