Update to 1 3 19 - #2
Open
FreddieAkeroyd wants to merge 107 commits into
Open
Conversation
Fixes some issues, if the discovery url includes a path (size calculation and memcpy fix).
Users might have manually created an inconsistent array. Defensive programming is good practice.
This was missed when the client reuses its SecureChannel structure. Some servers want the client to start the sequence number close to zero. Reported by Mike Granby in open62541#6177.
The code from stackoverflow was (by default) under CC-BY-SA license. This has raised some unclear points concerning copyleft.
Merge 1.2 to 1.3
Merge 1.2 to 1.3
The order of the locale and localizedText fields is different between the encoding mask and the encoded values in the body.
Merge 1.2 to 1.3
Merge 1.2 to 1.3
Some tests assume that async TCP connect(2) system call succeeds immediately when run over loopback device. This behavior depends on the implementation of the kernel, in OpenBSD this is often not the case. Allow the test client to iterate until the connection is established. Adapt the assertion how many iterations are needed.
Commit de9d691 fixed a use after free in UA_Client_AsyncService_cancel(). Move all elements to a local list before iterating over the callbacks. Commit 713cdb4 fixed the same bug in in asyncServiceTimeoutCheck(). After timeout, remove the async service calls from the global list and store them in a local one. Call UA_Client_AsyncService_cancel() and UA_free() while traversing this local list. Otherwise the callback could free a global list element that asyncServiceTimeoutCheck() is referencing.
This was problematic on MSVC where different NAN representations can be used as default.
…ata in the SessionContext This fixes open62541#7361
(cherry picked from commit bcb0219)
…ecting deadband value changes
…athsToNodeIds The TranslateBrowsePathsToNodeIds service did not call the allowBrowseNode access-control callback when resolving path elements or terminal targets. A client denied direct Browse access to a node could still use that node as a waypoint or receive its NodeId as a path translation result, disclosing hidden nodes and their children. Add the same allowBrowseNode gate already applied in the Browse service to both walkBrowsePathElement (intermediate nodes) and Operation_TranslateBrowsePathToNodeIds (terminal nodes). Internal Vulnerability Advisory: open62541-SA-2026-0004 Co-authored-by: keyme <kmm2003@users.noreply.github.com>
Rearrange the overflow check in Array_decodeBinary so that the
multiplication `type->memSize * length` cannot overflow before the
comparison. Instead of checking
ctx->pos + (type->memSize * length) / 128 <= ctx->end
which overflows when the product exceeds SIZE_MAX, rewrite it as
length / 128 <= remaining / type->memSize
where `remaining = ctx->end - ctx->pos`, keeping all operations in safe
size_t range.
Internal Vulnerability Advisory: open62541-SA-2026-0003
…overflow The JSON decoder for PubSub DataSetPayload casts the token count to UA_UInt16 without bounds checking. If a malicious or malformed message provides more than UA_UINT16_MAX/2 tokens, the cast silently truncates to a smaller value while the actual allocation uses the full (large) length. This can lead to heap buffer overflows and memory corruption. Add an explicit bounds check before the cast, rejecting messages with a field count that exceeds UA_UINT16_MAX. See: open62541-SA-2026-0001
…ents Variant_setRange uses sizeof(elem_size) instead of elem_size in the memset that zeros moved array elements. sizeof(elem_size) always evaluates to sizeof(size_t), which is 8 on 64-bit. For types with memSize > 8 (e.g. UA_String at 16 bytes), only half the struct is zeroed, leaving heap pointers dangling. This causes a double-free when both the source and the variant are cleared.
The default server configuration zero-initialises maxPublishReqPerSession, which disables the per-session cap on outstanding PublishRequest entries. A remote client that is allowed to create a session and a subscription can therefore send an unbounded number of PublishRequest messages, each of which allocates a UA_PublishResponseEntry and appends it to the session's publish queue. The resulting monotonic heap growth causes process memory exhaustion and a denial of service. Set a safe finite default of 512 outstanding PublishRequests per session in setDefaultConfig() so that the cap is enforced out of the box, while still allowing deployers to override it. Internal Vulnerability Advisory: open62541-SA-2026-0010 Co-Authored-By: keyme <kmm2003@users.noreply.github.com>
…ecoding Multiplying attacker-controlled arrayDimensions values into a size_t accumulator without an overflow check allows the product to wrap and match a small arrayLength. Subsequent ranged read or write operations then access memory outside the allocated array bounds. Add checked multiplication at all sites where the dimension product is computed: Variant binary decode, Variant binary encode, checkAdjustRange, and computeStrides (as a defence-in-depth measure). Internal Vulnerability Advisory: open62541-SA-2026-0012 and open62541-SA-2026-0013 Co-authored-by: Asher Davila <AsherDLL@users.noreply.github.com> Co-authored-by: Malav Vyas <MalavVyas@users.noreply.github.com>
Add bounds check in verifyAndDecrypt() to prevent unsigned integer underflow when buffer->length is smaller than the expected signature size. Without this check, the subtraction wraps around producing a large size_t that causes mbedtls to read unmapped memory. Internal Vulnerability Advisory: open62541-SA-2026-0014 Co-authored-by: Abhinav Agarwal <abhinavagarwal1996@gmail.com>
Operation_TransferSubscription() copies the UA_Subscription struct with memcpy but only migrates monitoredItems, notificationQueue, and retransmissionQueue. The samplingMonitoredItems list was not re-initialized in the new subscription, leaving stale le_prev backpointers from items with samplingType==PUBLISH pointing into the freed old subscription struct. When UA_MonitoredItem_unregisterSampling() calls LIST_REMOVE, it writes to freed memory (heap-use-after-free). Add migration of samplingMonitoredItems to the new subscription after the point of no return, matching the pattern used for monitoredItems. Internal Vulnerability Advisory: open62541-SA-2026-0015 Co-authored-by: Abhinav Agarwal <abhinavagarwal1996@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ISISComputingGroup/IBEX#8993