drivers/can: protect against write buffer overrun

The message size is being calculated from the message itself. If
application sets value cm_hdr.ch_dlc greater than buflen (that is
size_t) then calculation in while condition underflows and multiple
messages are attempted to be sent.

This check prevents that by verifying that the message size that was
encoded in the dlc is not greater than indicated size of the buffer.

Signed-off-by: Karel Kočí <cynerd@email.cz>

drivers/can/can.c

@@ -679,6 +679,13 @@ static ssize_t can_write(FAR struct file *filep, FAR const char *buffer,
       nbytes = can_dlc2bytes(msg->cm_hdr.ch_dlc);
       msglen = CAN_MSGLEN(nbytes);
 
+      if (nsent + msglen > buflen)
+        {
+          /* Do not send message if not fully passed. */
+
+          break;
+        }
+
       can_add_sendnode(sender, msg, msglen);
 
       /* Increment the number of bytes that were sent */