From f43451b7df1ef7c95e4b7c49333fe13b30b3e917 Mon Sep 17 00:00:00 2001 From: David Sidrane Date: Wed, 5 Dec 2018 21:24:59 +0000 Subject: [PATCH] Merged in david_s5/nuttx/master_f7_i2c (pull request #774) stm32f7:i2c out of bounds access on priv->msgv Error in if statment. It was checking for msgc > 0. If message count is 1, only index 0 is valid on priv->msgv. There for random values in memory were used to set next_norestart. Approved-by: GregoryN --- arch/arm/src/stm32f7/stm32_i2c.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm/src/stm32f7/stm32_i2c.c b/arch/arm/src/stm32f7/stm32_i2c.c index 51a9f31b550..da86f7318ff 100644 --- a/arch/arm/src/stm32f7/stm32_i2c.c +++ b/arch/arm/src/stm32f7/stm32_i2c.c @@ -1464,7 +1464,9 @@ static inline void stm32_i2c_sendstart(FAR struct stm32_i2c_priv_s *priv) * it otherwise. */ - if (priv->msgc > 0) + /* Check if there are multiple messages and the next is a continuation */ + + if (priv->msgc > 1) { next_norestart = (((priv->msgv + 1)->flags & I2C_M_NOSTART) != 0); }