CVE-2026-13217: memory-safety in zephyrproject zephyr

The OCPP 1.6 client in Zephyr reconstructs session handles and PDU IDs from the uid field of CALLRESULT messages. The function ocpp_process_server_msg() calls atoi(strtok_r(uid, "-", &tmp)) without checking if strtok_r returns NULL. If the uid is empty or lacks the '-' delimiter, strtok_r returns NULL, and atoi(NULL) causes undefined behavior due to a NULL pointer dereference. The uid is sourced from network data parsed from JSON frames received over TCP/WebSocket from the OCPP central system. A malicious or compromised server or a man-in-the-middle on an unencrypted connection can supply malformed uid values to trigger this defect. On platforms with MMU/MPU or NULL pointer exception detection enabled, this results in a fault and invokes a fatal handler, causing a remote denial of service of the charge point. On bare-metal platforms where address 0 is readable, the call returns 0 and is benign, limiting impact to availability and platform-dependent. The existing fix guards only the first atoi() call; the second strtok_r(NULL, "-", &tmp) followed by atoi(buf) remains unguarded, leaving the NULL dereference reachable when the uid has a first token but no second token. A complete fix should validate both tokens.

The vulnerability allows a remote attacker controlling the OCPP central system or positioned as a man-in-the-middle on a non-TLS connection to cause a NULL pointer dereference in the Zephyr OCPP client. This results in a denial of service by crashing the OCPP reader thread and invoking the fatal handler on platforms that trap NULL pointer accesses. On platforms without such trapping, the impact is benign and limited to returning 0. There is no impact on confidentiality or integrity, only availability, and the severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The existing partial fix guards only the first atoi() call, leaving a similar NULL dereference reachable. Until a complete fix is available, avoid using non-TLS ws:// connections to prevent man-in-the-middle attacks that could supply malformed uid values. Monitor vendor advisories for updates addressing the second unguarded strtok_r and atoi() calls.