mirror of
https://github.com/apache/nuttx.git
synced 2026-08-07 05:27:17 +00:00
ca73f0e9e5
A malformed packet can trigger memory corruption in the kernel leading to a system crash or potentially arbitrary code execution in the kernel. The CAN driver for the CTU CAN FD IP Core connected to the NuttX device via a PCI / PCI Express (PCIe) bus shows a lack of consideration for malformed data, assuming the CAN frames are always correct. Ensure `frame->fmt.rwcnt` is 21 or less before it is used in the `for` loop. A similar change was done in ctucanfd_sock_recv(). Tested locally, builds fine. Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com> |
||
|---|---|---|
| .. | ||
| can.c | ||
| can_common.c | ||
| can_sender.c | ||
| CMakeLists.txt | ||
| ctucanfd.h | ||
| ctucanfd_pci.c | ||
| Kconfig | ||
| kvaser_pci.c | ||
| Make.defs | ||
| mcp2515.c | ||
| mcp2515.h | ||
| sja1000.c | ||
| sja1000.h | ||