Mirrors_Framework/nuttx
1
0
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2025-12-15 00:41:51 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

rpmsg_ping.c: fix msg data memset length

Browse Source 
The range of memset exceeds the size of the buffer

Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
This commit is contained in:
Yongrong Wang
2024-07-23 11:15:16 +08:00
committed by GUIDINGLI
parent 4b77dd03db
commit 976c4173f0
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/rpmsg/rpmsg_ping.c
View File

@@ -101,8 +101,6 @@ static int rpmsg_ping_ept_cb(FAR struct rpmsg_endpoint *ept,
i, data_len); i, data_len);
break; break;
} }
msg->data[i] = 0;
} }
} }
@@ -132,9 +130,6 @@ static int rpmsg_ping_once(FAR struct rpmsg_endpoint *ept, int len,
return -ENOMEM; return -ENOMEM;
} }
len = MAX(len, sizeof(struct rpmsg_ping_msg_s));
len = MIN(len, *buf_len);
msg->cmd = cmd; msg->cmd = cmd;
if ((msg->cmd & RPMSG_PING_RANDOMLEN_MASK) != 0) if ((msg->cmd & RPMSG_PING_RANDOMLEN_MASK) != 0)
@@ -146,13 +141,16 @@ static int rpmsg_ping_once(FAR struct rpmsg_endpoint *ept, int len,
msg->len = len; msg->len = len;
} }
msg->len = MAX(msg->len, sizeof(struct rpmsg_ping_msg_s));
msg->len = MIN(msg->len, *buf_len);
if ((msg->cmd & RPMSG_PING_CHECK_MASK) != 0) if ((msg->cmd & RPMSG_PING_CHECK_MASK) != 0)
{ {
memset(msg->data, i, msg->len - sizeof(struct rpmsg_ping_msg_s) + 1); memset(msg->data, i, msg->len - sizeof(struct rpmsg_ping_msg_s) + 1);
} }
else else
{ {
memset(msg->data, 0, msg->len); memset(msg->data, 0, msg->len - sizeof(struct rpmsg_ping_msg_s) + 1);
} }
if ((msg->cmd & RPMSG_PING_ACK_MASK) != 0) if ((msg->cmd & RPMSG_PING_ACK_MASK) != 0)