From a19971f1bcaeb06060f9aed013d1cbf924f93124 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= Date: Tue, 14 Oct 2025 15:41:52 +0200 Subject: [PATCH] drivers/can: protect against write buffer overrun MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The message size is being calculated from the message itself. If application sets value cm_hdr.ch_dlc greater than buflen (that is size_t) then calculation in while condition underflows and multiple messages are attempted to be sent. This check prevents that by verifying that the message size that was encoded in the dlc is not greater than indicated size of the buffer. Signed-off-by: Karel Kočí --- drivers/can/can.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/can/can.c b/drivers/can/can.c index f342d20b316..08dc85c1a49 100644 --- a/drivers/can/can.c +++ b/drivers/can/can.c @@ -679,6 +679,13 @@ static ssize_t can_write(FAR struct file *filep, FAR const char *buffer, nbytes = can_dlc2bytes(msg->cm_hdr.ch_dlc); msglen = CAN_MSGLEN(nbytes); + if (nsent + msglen > buflen) + { + /* Do not send message if not fully passed. */ + + break; + } + can_add_sendnode(sender, msg, msglen); /* Increment the number of bytes that were sent */