Skip to content

v1.0.4

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 17:33
· 4 commits to main since this release
v1.0.4
dbdf055
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security and correctness fix for tag addresses. Upgrade if you write to S7comm PLCs, in particular with large DB offsets, timers or counters.

Highlights

  • Out-of-range addresses are now rejected. Before this release, a byte offset above 2097151 did not fit in the 24-bit address field of the S7comm request and wrapped around: DB1.DBB2097152 read and wrote DB1.DBB0. Timer and counter numbers above 65535 lost their high bits, and an element count above 32767 (T5[70000]) was cut. A very large count made the connection thread panic, and that connection stopped working. All three address syntaxes (Siemens, parse_tag and nodes7) now give an error such as DB1.DBB2097152: address out of range (byte offset 0-2097151).
  • Fuzz testing. The parsers of PLC replies (S7comm and S7CommPlus) and of tag addresses run under cargo-fuzz in CI on every change and for 10 minutes each week. The fuzzer found the address bug above.

Upgrade notes

  • A flow with an out-of-range tag now gets an error for that tag instead of a value from another address. Valid addresses do not change.
  • No change to the nodes, their settings or the supported PLCs.

Details (CHANGELOG)

Fixed

  • Tag addresses out of the S7 address range are now an error. Before, a byte offset past 2097151 (DB1.DBB2097152) wrapped in the 24-bit address field and reached another address (DB1.DBB0), a timer/counter number past 65535 lost its high bits, and a count past 32767 (T5[70000]) was cut (and a very large one made the connection thread panic). All three address syntaxes check the range.

Added

  • Fuzzing: cargo-fuzz targets for S7comm replies (COTP, S7 header, ReadVar data, Userdata), tag addresses and values, block information and clock, S7CommPlus PDU reassembly, messages, values, objects, notifications, alarm texts and comment blobs (fuzz/, CI workflow fuzz.yml).

Changed

  • GitHub releases start with a summary for users (.github/release-notes/), then the CHANGELOG section.
  • CI: cargo-zigbuild installed from a hash-pinned requirements file; Node-RED 4 tests use the locked alias node-red-4 (no unpinned npm install); node-red-dev pinned; SECURITY.md links the private reporting form.

Full diff: v1.0.3...v1.0.4

Assets 3
Loading