Mirrors_Framework/rtems
1
0
Fork 0
mirror of https://gitlab.rtems.org/rtems/rtos/rtems.git synced 2026-08-21 09:08:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

cpukit/can: Fix out-of-bounds array access

Browse Source 
Add bounds checking to txtb_id to prevent out-of-bounds writes
in the TX buffer array. Fixes Coverity CID 1642617 and resolves
Issue #5248.
This commit is contained in:
M Mithilesh
2026-02-27 15:49:12 -06:00
committed by Kinsey Moore
parent 85b155e596
commit 1af2b99fa9
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cpukit/dev/can/ctucanfd/ctucanfd.c
+7 -1
View File
@@ -1312,6 +1312,9 @@ static rtems_task ctucanfd_worker( rtems_task_argument arg )
for ( int i = 0; i < internal->txb_prio_tail[ 0 ]; i++ ) {
txtb_id = ctucanfd_txb_from_order( internal->txb_order, i );
if ( txtb_id >= internal->ntxbufs ) {
continue;
}
if ( ctucanfd_get_tx_status( internal, txtb_id ) == TXT_ETY ) {
txb_info = &internal->txb_info[ txtb_id ];
if ( txb_info != NULL ) {
@@ -1366,7 +1369,10 @@ static rtems_task ctucanfd_worker( rtems_task_argument arg )
);
ctucanfd_check_state( internal, "before insert_frame" );
/* Insert frame to HW buffer */
bool ok = ctucanfd_insert_frame( internal, &slot->frame, txtb_id );
bool ok = false;
if ( txtb_id < internal->ntxbufs ) {
ok = ctucanfd_insert_frame( internal, &slot->frame, txtb_id );
}
if ( ok == true ) {
/* Frame inserted successfully, update TX buffer representation,
* buffer priorities and set buffer as ready.