Open-SAE-J1939 Integer Underflow Vulnerability Leading to Out-of-Bounds Write

A vulnerability exists in the Open-SAE-J1939 library for handling the J1939 Transport Protocol Data Transfer. The issue arises from an integer underflow that allows for an out-of-bounds write. Specifically, when the sequence number from a CAN frame is zero, the calculated index underflows and results in a write operation that exceeds the allocated buffer size. This vulnerability is present in versions through commit 744024d4306bc387857dfce439558336806acb06.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, leading to heap corruption.

Reproduction

The vulnerability can be reproduced by sending a crafted CAN frame with a sequence number of zero. This will trigger the integer underflow, causing the subsequent write operation to exceed the maximum buffer size by six bytes.