When requesting a non-configured DID via the ReadDataByIdentifier (0x22) service, due to a bug in the Dcm_Dsp.c, internal function FindDidByIdentifier(), an array out-of-bounds access can take place.
The issue was introduced in software version V8.36.5-Delivery-Build26338 (2406 milestone release) and is present in all subsequent versions up to but not including the 2412 milestone release.
Issue trigger conditions:
The issue can only appear if all the following conditions are satisfied when requesting a DID through ReadDataByIdentifier (0x22) service:
The condition for breaking the loop should be if (index == 0U) instead of if (endIndex == 0U). The current condition causes endIndex, when the trigger conditions are satisfied, to be set to index – 1 (65535 as the index is a 16-bit unsigned integer), leading to an out-of-bounds access.
Configuring a DID with the identifier 0x0000, if not already done, with DcmDspDidUsed (false) will prevent the issue from occurring.
Fix will be part of the 2412 milestone release.