EVerest / EVerest/cbexigen

Array out of bounds if number of PMaxScheduleEntry is too high

Open
#124 1 comment 0 reactions 2 assignees Claimed by @chausGit View on GitHub
bug
Dominant language
Python
Stars
69
Forks
36
Avg merge
3h 30m
Merged PRs (30d)
1

Description

### Describe the bug

When decoding a ChargeParameterDiscoveryRes with 16 PMaxScheduleEntry the decoding fails with error `EXI_ERROR__ARRAY_OUT_OF_BOUNDS`. The `config.py` is adapted accordingly, but it still does not work.

### To Reproduce

config.py:
```py
iso2_array_optimizations = {
'PMaxScheduleEntryType': 16,
...
```
Test application:
```cpp
#include

#include

int main() {
// Example EXI stream of a ChargeParameterDiscoveryRes
uint8_t exi_raw[] = {
0x80, 0x98, 0x02, 0x13, 0xec, 0x5a, 0xca, 0x94, 0xcd, 0xc8, 0x4c, 0x90,
0xa0, 0x00, 0x00, 0x12, 0x00, 0x00, 0x34, 0x03, 0xc1, 0x85, 0x01, 0xe0,
0x06, 0x80, 0x78, 0x74, 0x03, 0x83, 0x0a, 0x03, 0x20, 0x0a, 0x01, 0xf0,
0x9a, 0x08, 0x06, 0x14, 0x06, 0x80, 0x17, 0x44, 0xe0, 0x64, 0x00, 0x28,
0x00, 0x80, 0x3b, 0x09, 0xc2, 0x10, 0x1c, 0x18, 0x50, 0x21, 0x00, 0x78,
0x17, 0x07, 0x40, 0x38, 0x30, 0xa0, 0x32, 0x00, 0xd8, 0x36, 0x0e, 0x80,
0x70, 0x61, 0x40, 0x68, 0x01, 0x80, 0x7c, 0x1d, 0x00, 0xe0, 0x02, 0x80,
0x08, 0x02, 0xa1, 0x18, 0x3a, 0x01, 0xc1, 0x85, 0x02, 0x10, 0x04, 0x82,
0x70, 0x74, 0x03, 0x83, 0x0a, 0x03, 0x20, 0x0f, 0x85, 0x50, 0xe8, 0x07,
0x06, 0x14, 0x06, 0x80, 0x1c, 0x0b, 0xa1, 0xd0, 0x0e, 0x00, 0x28, 0x00,
0x80, 0x32, 0x19, 0x43, 0xa0, 0x1c, 0x18, 0x50, 0x21, 0x00, 0x58, 0x36,
0x87, 0x40, 0x38, 0x30, 0xa0, 0x34, 0x00, 0x98, 0x75, 0x0e, 0x80, 0x70,
0x01, 0x40, 0x04, 0x01, 0x00, 0xfa, 0x1d, 0x00, 0xe0, 0xc2, 0x81, 0x08,
0x44, 0x00, 0x03, 0xea, 0x6c, 0x2d, 0x8c, 0xae, 0x64, 0x0a, 0x8e, 0x4c,
0x2d, 0x2c, 0xcc, 0xc4, 0x0e, 0xed, 0x2e, 0x8d, 0x04, 0x0d, 0xce, 0xad,
0xac, 0x4c, 0xae, 0x44, 0x04, 0xe6, 0xa6, 0xa4, 0xe0, 0x06, 0x00, 0x00,
0x70, 0x09, 0x00, 0x04, 0x06, 0x28, 0x00, 0x00, 0x06, 0x40, 0xc0, 0x43,
0x20, 0x30, 0x20, 0x00, 0x0c, 0x03, 0x0a, 0x01, 0x40, 0x03, 0x20, 0x40,
0x10, 0xc8, 0x14, 0x08, 0x05, 0x06, 0x00, 0x02, 0x80, 0x50, 0x00, 0xc8,
0x00, 0x04, 0x32, 0x01, 0x02, 0x01, 0x40, 0x80, 0x0d, 0x80, 0x42, 0x19,
0x00, 0xc2, 0x80, 0x50, 0x00, 0x64, 0x0c, 0x04, 0x32, 0x03, 0x02, 0x00,
0x00, 0xc0, 0x30, 0xa0, 0x14, 0x00, 0x00, 0x84, 0x01, 0x00, 0x41, 0x40,
0x80, 0x18, 0x60, 0x00, 0x28, 0x05, 0x00, 0x00, 0x80, 0x00, 0x40, 0x28,
0x10, 0x20, 0x0c, 0x08, 0x00, 0xd8, 0x04, 0x01, 0x41, 0x18, 0x50, 0x14,
0x00, 0x0c, 0xc1, 0x80, 0x86, 0x50, 0x60, 0x41, 0x98, 0x18, 0x06, 0x14,
0x05, 0x40, 0x00, 0xa2, 0x08, 0x01, 0x21, 0x00, 0xa2, 0x06, 0x14, 0x05,
0x80, 0x00, 0x92, 0x08, 0x00, 0x21, 0x00, 0xa2, 0x01, 0xb0, 0x08, 0x1d,
0x00, 0xe0, 0xff, 0x03, 0x0a, 0x02, 0x80, 0x01, 0x91, 0x04, 0x32, 0x10,
0x80, 0x01, 0x03, 0x0a, 0x02, 0x60, 0x01, 0x91, 0x04, 0x32, 0x10, 0x80,
0x01, 0x03, 0x0a, 0x02, 0xa0, 0x01, 0x91, 0x04, 0x32, 0x10, 0x80, 0x01,
0x00, 0xf0, 0x9f, 0x05, 0x0f, 0x09, 0xf0, 0x51, 0x18, 0x50, 0x14, 0x00,
0x0c, 0x81, 0x80, 0x86, 0x40, 0x60, 0x43, 0x20, 0x04, 0x30, 0x04, 0x14,
0x02, 0x80, 0x03, 0x20, 0x60, 0x21, 0x90, 0x18, 0x10, 0xc8, 0x01, 0x0c,
0x01, 0x85, 0x00, 0xf0, 0x00, 0xc8, 0x18, 0x08, 0x64, 0x06, 0x04, 0x32,
0x00, 0x43, 0x02, 0x00, 0xa0, 0x00, 0x04, 0x61, 0x40, 0x28, 0x00, 0x78,
0x43, 0x14, 0x3a, 0x01, 0xc0, 0x16, 0x80, 0x21, 0x01, 0x46, 0x0a, 0x06,
0x28, 0x00, 0x04, 0x40, 0x00, 0x3e, 0xa6, 0xc2, 0xd8, 0xca, 0xe6, 0x40,
0xa8, 0xe4, 0xc2, 0xd2, 0xcc, 0xcc, 0x40, 0xee, 0xd2, 0xe8, 0xd0, 0x40,
0xdc, 0xea, 0xda, 0xc4, 0xca, 0xe4, 0x40, 0x4e, 0x6a, 0x64, 0x4e, 0x00,
0x60, 0x00, 0x07, 0x00, 0x90, 0x00, 0x40, 0x62, 0x80, 0x00, 0x00, 0x64,
0x0c, 0x04, 0x32, 0x03, 0x02, 0x00, 0x00, 0xc0, 0x30, 0xa0, 0x14, 0x00,
0x32, 0x04, 0x01, 0x0c, 0x81, 0x40, 0x80, 0x50, 0x60, 0x00, 0x28, 0x05,
0x00, 0x0c, 0x80, 0x00, 0x43, 0x20, 0x10, 0x20, 0x14, 0x08, 0x00, 0xd8,
0x04, 0x21, 0x90, 0x0c, 0x28, 0x05, 0x00, 0x06, 0x40, 0xc0, 0x43, 0x20,
0x30, 0x20, 0x00, 0x0c, 0x03, 0x0a, 0x01, 0x40, 0x00, 0x08, 0x40, 0x10,
0x04, 0x14, 0x08, 0x01, 0x86, 0x00, 0x02, 0x80, 0x50, 0x00, 0x08, 0x00,
0x04, 0x02, 0x81, 0x02, 0x00, 0xc0, 0x80, 0x0d, 0x80, 0x40, 0x14, 0x11,
0x85, 0x01, 0x40, 0x00, 0xcc, 0x18, 0x08, 0x65, 0x06, 0x04, 0x19, 0x81,
0x80, 0x61, 0x40, 0x54, 0x00, 0x0a, 0x20, 0x80, 0x12, 0x10, 0x0a, 0x20,
0x61, 0x40, 0x58, 0x00, 0x09, 0x20, 0x80, 0x02, 0x10, 0x0a, 0x20, 0x1b,
0x00, 0x81, 0xd0, 0x0e, 0x0f, 0xf0, 0x30, 0xa0, 0x28, 0x00, 0x19, 0x10,
0x43, 0x21, 0x08, 0x00, 0x10, 0x30, 0xa0, 0x26, 0x00, 0x19, 0x10, 0x43,
0x21, 0x08, 0x00, 0x10, 0x30, 0xa0, 0x2a, 0x00, 0x19, 0x10, 0x43, 0x21,
0x08, 0x00, 0x10, 0x0f, 0x09, 0xf0, 0x50, 0xf0, 0x9f, 0x05, 0x11, 0x85,
0x01, 0x40, 0x00, 0xc8, 0x18, 0x08, 0x64, 0x06, 0x04, 0x32, 0x00, 0x43,
0x00, 0x41, 0x40, 0x28, 0x00, 0x32, 0x06, 0x02, 0x19, 0x01, 0x81, 0x0c,
0x80, 0x10, 0xc0, 0x18, 0x50, 0x0f, 0x00, 0x0c, 0x81, 0x80, 0x86, 0x40,
0x60, 0x43, 0x20, 0x04, 0x30, 0x20, 0xfe, 0x00, 0x00, 0x1a, 0x01, 0xe0,
0xc2, 0x80, 0xf0, 0x03, 0x40, 0x3c, 0x3a, 0x01, 0xc1, 0x85, 0x01, 0x90,
0x05, 0x00, 0xf8, 0x4d, 0x04, 0x03, 0x0a, 0x03, 0x40, 0x0b, 0xa2, 0x70,
0x32, 0x00, 0x14, 0x00, 0x40, 0x1d, 0x84, 0xe1, 0x08, 0x0e, 0x0c, 0x28,
0x10, 0x80, 0x3c, 0x0b, 0x83, 0xa0, 0x1c, 0x18, 0x50, 0x19, 0x00, 0x6c,
0x1b, 0x07, 0x40, 0x38, 0x30, 0xa0, 0x34, 0x00, 0xc0, 0x3e, 0x0e, 0x80,
0x70, 0x01, 0x40, 0x04, 0x01, 0x50, 0x8c, 0x1d, 0x00, 0xe0, 0xc2, 0x81,
0x08, 0x02, 0x41, 0x38, 0x3a, 0x01, 0xc1, 0x85, 0x01, 0x90, 0x07, 0xc2,
0xa8, 0x74, 0x03, 0x83, 0x0a, 0x03, 0x40, 0x0e, 0x05, 0xd0, 0xe8, 0x07,
0x00, 0x14, 0x00, 0x40, 0x19, 0x0c, 0xa1, 0xd0, 0x0e, 0x0c, 0x28, 0x10,
0x80, 0x2c, 0x1b, 0x43, 0xa0, 0x1c, 0x18, 0x50, 0x1a, 0x00, 0x4c, 0x3a,
0x87, 0x40, 0x38, 0x00, 0xa0, 0x02, 0x00, 0x80, 0x7d, 0x0e, 0x80, 0x70,
0x61, 0x40, 0x84, 0x22, 0x00, 0x01, 0xf5, 0x36, 0x16, 0xc6, 0x57, 0x32,
0x05, 0x47, 0x26, 0x16, 0x96, 0x66, 0x62, 0x07, 0x76, 0x97, 0x46, 0x82,
0x06, 0xe7, 0x56, 0xd6, 0x26, 0x57, 0x22, 0x02, 0x73, 0x53, 0x62, 0x70,
0x03, 0x00, 0x00, 0x38, 0x04, 0x80, 0x02, 0x03, 0x14, 0x00, 0x00, 0x03,
0x20, 0x60, 0x21, 0x90, 0x18, 0x10, 0x00, 0x06, 0x01, 0x85, 0x00, 0xa0,
0x01, 0x90, 0x20, 0x08, 0x64, 0x0a, 0x04, 0x02, 0x83, 0x00, 0x01, 0x40,
0x28, 0x00, 0x64, 0x00, 0x02, 0x19, 0x00, 0x81, 0x00, 0xa0, 0x40, 0x06,
0xc0, 0x21, 0x0c, 0x80, 0x61, 0x40, 0x28, 0x00, 0x32, 0x06, 0x02, 0x19,
0x01, 0x81, 0x00, 0x00, 0x60, 0x18, 0x50, 0x0a, 0x00, 0x00, 0x42, 0x00,
0x80, 0x20, 0xa0, 0x40, 0x0c, 0x30, 0x00, 0x14, 0x02, 0x80, 0x00, 0x40,
0x00, 0x20, 0x14, 0x08, 0x10, 0x06, 0x04, 0x00, 0x6c, 0x02, 0x00, 0xa0,
0x8c, 0x28, 0x0a, 0x00, 0x06, 0x60, 0xc0, 0x43, 0x28, 0x30, 0x20, 0xcc,
0x0c, 0x03, 0x0a, 0x02, 0xa0, 0x00, 0x51, 0x04, 0x00, 0x90, 0x80, 0x51,
0x03, 0x0a, 0x02, 0xc0, 0x00, 0x49, 0x04, 0x00, 0x10, 0x80, 0x51, 0x00,
0xd8, 0x04, 0x0e, 0x80, 0x70, 0x7f, 0x81, 0x85, 0x01, 0x40, 0x00, 0xc8,
0x82, 0x19, 0x08, 0x40, 0x00, 0x81, 0x85, 0x01, 0x30, 0x00, 0xc8, 0x82,
0x19, 0x08, 0x40, 0x00, 0x81, 0x85, 0x01, 0x50, 0x00, 0xc8, 0x82, 0x19,
0x08, 0x40, 0x00, 0x80, 0x78, 0x4f, 0x82, 0x87, 0x84, 0xf8, 0x28, 0x8c,
0x28, 0x0a, 0x00, 0x06, 0x40, 0xc0, 0x43, 0x20, 0x30, 0x21, 0x90, 0x02,
0x18, 0x02, 0x0a, 0x01, 0x40, 0x01, 0x90, 0x30, 0x10, 0xc8, 0x0c, 0x08,
0x64, 0x00, 0x86, 0x00, 0xc2, 0x80, 0x78, 0x00, 0x64, 0x0c, 0x04, 0x32,
0x03, 0x02, 0x19, 0x00, 0x21, 0x81, 0x10, 0x00, 0x00, 0x80, 0x40, 0x83,
0x08, 0x82, 0x70, 0x41, 0x42, 0x61, 0xd4, 0x08, 0x40, 0x90, 0x4e, 0x00,
0x0c, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x60, 0x00, 0x02, 0x18, 0x22,
0x09, 0xc0
};

exi_bitstream_t exi_stream_in;
exi_bitstream_init(&exi_stream_in, exi_raw, sizeof(exi_raw), 0, nullptr);
iso2_exiDocument value{};
int code = decode_iso2_exiDocument(&exi_stream_in, &value);
std::cout << "Return Code: " << code << std::endl;

return 0;
}
```

### Anything else?

This problem was introduced with commit 123df71. If I revert the changes in base_coder_classes.py, lines [630 to 648](https://github.com/EVerest/cbexigen/commit/123df71f74bf425f97d10794ad16df418078e23f#diff-31dcd1f9445dbc2cb3133f248fc39c0d34a95397086926817f6d35f03c5fce0dR630-R648), it works. However, I am not sure what these changes do. So I am not able to open a pull request.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.