Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

drivers/can/ctucanfd_pci: Fix Malformed CAN Data Msg (address off-by-one)

Browse source 
PR https://github.com/apache/nuttx/pull/19139 addresses the issue, but there
is one minor problem. In the for loop the element `i+1` is written which
means there can still be an overflow by one element (uint32_t or 4 bytes).

Addressing here with this PR.

Tested locally, builds fine.

Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This commit is contained in:
Catalin Visinescu 2026-06-17 09:50:11 -04:00 • committed by Alan C. Assis
parent 5c8fa78c4e
commit b840bf6552
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/can/ctucanfd_pci.c
View file

@ -762,7 +762,7 @@ static void ctucanfd_chardev_receive(FAR struct ctucanfd_can_s *priv)
/* buff[0] populated the frame->fmt.rwcnt. Check before use. */
if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]))
if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]) - 1)
{
canerr("ERROR: CAN read/write count is too large. Dropped\n");
return;
@ -1259,7 +1259,7 @@ static FAR netpkt_t *ctucanfd_sock_recv(FAR struct netdev_lowerhalf_s *dev)
/* buff[0] populated the frame->fmt.rwcnt. Check before use. */
if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]))
if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]) - 1)
{
canerr("ERROR: CAN read/write count is too large. Dropped\n");
return NULL;