From e29799cba6f1d08cf6463a2b190c0e6502b885df Mon Sep 17 00:00:00 2001 From: Michael Zillgith Date: Fri, 2 Feb 2024 06:44:47 +0000 Subject: [PATCH] CVE-2024-26529 fixed - null pointer dereference in mmsServer_handleDeleteNamedVariableListRequest when receiving malformed message (LIB61850-430) CVE: CVE-2024-26529 Upstream-Status: Backport [https://github.com/mz-automation/libiec61850/commit/cf94d64206cf53298edf4799a75b31657bb7cbb3] (cherry picked from commit cf94d64206cf53298edf4799a75b31657bb7cbb3) Signed-off-by: Ankur Tyagi --- src/mms/iso_mms/server/mms_named_variable_list_service.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/mms/iso_mms/server/mms_named_variable_list_service.c b/src/mms/iso_mms/server/mms_named_variable_list_service.c index 3a27061c..3365f771 100644 --- a/src/mms/iso_mms/server/mms_named_variable_list_service.c +++ b/src/mms/iso_mms/server/mms_named_variable_list_service.c @@ -140,6 +140,12 @@ mmsServer_handleDeleteNamedVariableListRequest(MmsServerConnection connection, mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response); goto exit_function; } + + if (request->listOfVariableListName == NULL) + { + mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response); + goto exit_function; + } long scopeOfDelete = DeleteNamedVariableListRequest__scopeOfDelete_specific;