softing FwParse OOB

Vulnerability analysis

The Softing CAN card firmware parser reads record headers, payloads, and checksums from a firmware blob without validating that those reads stay within the blob's bounds, so a truncated or crafted record can cause out-of-bounds reads. The same records also supply addresses and lengths for copying data into DPRAM memory; the generic loader used mixed signed arithmetic that could wrap around and bypass the bounds check, while the application loader performed no bounds check at all before writing. The fix passes the firmware end pointer into the parser and validates the full record span before reading, uses a wide signed offset to prevent arithmetic wrap-around in the generic DPRAM copy, and validates the application staging span against the mapped DPRAM size before copying. The vulnerable code path is reached when loading firmware for a Softing CAN card, which requires the softing driver to be loaded and access to the firmware file, typically needing local privileges to trigger.