From 6776e2ea9a5e1ddda389efe9fe2b678a35844092 Mon Sep 17 00:00:00 2001
From: Theo Arends <11044339+arendst@users.noreply.github.com>
Date: Sat, 17 Oct 2026 14:17:59 +0200
Subject: [PATCH] Fix Modbus OOB

---
 tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index 0e9cf07d9..403a83d15 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -782,6 +782,11 @@ void ModbusTCPHandle(void)
         {
           // For functioncode 15 & 16 ignore bytecount, modbusBridgeModbus does calculate this
           uint8_t dataStartByte = mbfunctioncode <= 6 ? 10 : 13;
+          if (dataStartByte > buf_len) {
+            AddLog(LOG_LEVEL_ERROR, PSTR("MBS: data start larger than buffer"));
+            return;
+          }
+
           uint16_t byteCount = (buf_len - dataStartByte);
           modbusBridge.byteCount = 2;
           modbusBridge.dataCount = 1;