RT-Labs P-Net

Out-of-bounds write when parsing AR Vendor Block requests

Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness

Infinite loop when reading PDPortDataCheck record of subslot 0

Resource exhaustion from RPC sessions kept for requests to unknown interface

NULL pointer dereference on implicit read of user specific record index

NULL pointer dereference on implicit read of AR specific record index

Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length

Out-of-bounds write with too many MCR blocks in a Connect request

Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()

Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()

RPC session pool exhausted by unfinished fragmented requests

A DCP Set of the IP suite that is refused is still stored

Alarm frames are accepted from any source address

RT-Labs P-Net: Out-of-bounds Write

NULL pointer dereference when a response fragment is not acknowledged

Fragment with another data representation releases an Application Relationship

RPC reject, fault and cancel PDUs abort an Application Relationship

RT-Labs P-Net: Heap-based Buffer Overflow

RT-Labs P-Net: Heap-based Buffer Overflow

RT-Labs P-Net: Heap-based Buffer Overflow

RT-Labs P-Net: Out-of-bounds Write

RT-Labs P-Net: NULL Pointer Dereference

Out-of-bounds read of DCP block header in DCP Set and Identify request parsing

RT-Labs P-Net: Unchecked Input for Loop Condition

Alarm data length not validated against received frame length