From a92635afde19ceb1b05bf796b1fbed70361734d9 Mon Sep 17 00:00:00 2001 From: Mike German Date: Mon, 6 Jul 2026 21:31:06 -0400 Subject: [PATCH] fix(cobs): avoid out-of-bounds read in apex_cobs_decode_framed on all-zero input MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The leading-delimiter skip loop tested `input[i]` before `i < length`: while (input[i] == 0x00 && i < length) i++; Because `&&` short-circuits left-to-right, `input[i]` is read before the bound is checked. When the input is entirely 0x00 (an idle/low UART line, or a run of frame delimiters — both plausible on a real wire), `i` advances to `length` and `input[length]` is read one byte past the buffer before the loop exits. AddressSanitizer confirms a heap-buffer-overflow READ here. Swap the operands so the bound is checked first: while (i < length && input[i] == 0x00) i++; Behavior is otherwise unchanged: an all-zero buffer is still rejected as APEX_ERR_MALFORMED, and valid framed messages round-trip as before. The sibling trailing-delimiter loop is already safe (its index is bounded below by `i`). Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Mike German --- lib/src/apex_cobs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/src/apex_cobs.c b/lib/src/apex_cobs.c index b484f1f..575c8ba 100644 --- a/lib/src/apex_cobs.c +++ b/lib/src/apex_cobs.c @@ -155,7 +155,7 @@ apex_status_t apex_cobs_decode_framed(const uint8_t *input, } i = 0; - while (input[i] == 0x00 && i < length) { + while (i < length && input[i] == 0x00) { i++; } if (length - i <= 1) {