From 1af2b99fa9e53bd6ab1fcb0ebcab21699fa7917f Mon Sep 17 00:00:00 2001
From: M Mithilesh <mithilehm24@iitk.ac.in>
Date: Thu, 26 Feb 2026 15:02:12 +0530
Subject: [PATCH] cpukit/can: Fix out-of-bounds array access

Add bounds checking to txtb_id to prevent out-of-bounds writes
in the TX buffer array. Fixes Coverity CID 1642617 and resolves
Issue #5248.
---
 cpukit/dev/can/ctucanfd/ctucanfd.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/cpukit/dev/can/ctucanfd/ctucanfd.c b/cpukit/dev/can/ctucanfd/ctucanfd.c
index e1e1f7baa8..4c5c1149da 100644
--- a/cpukit/dev/can/ctucanfd/ctucanfd.c
+++ b/cpukit/dev/can/ctucanfd/ctucanfd.c
@@ -1312,6 +1312,9 @@ static rtems_task ctucanfd_worker( rtems_task_argument arg )
       for ( int i = 0; i < internal->txb_prio_tail[ 0 ]; i++ ) {
         txtb_id = ctucanfd_txb_from_order( internal->txb_order, i );
 
+        if ( txtb_id >= internal->ntxbufs ) {
+          continue;
+        }
         if ( ctucanfd_get_tx_status( internal, txtb_id ) == TXT_ETY ) {
           txb_info = &internal->txb_info[ txtb_id ];
           if ( txb_info != NULL ) {
@@ -1366,7 +1369,10 @@ static rtems_task ctucanfd_worker( rtems_task_argument arg )
         );
         ctucanfd_check_state( internal, "before insert_frame" );
         /* Insert frame to HW buffer */
-        bool ok = ctucanfd_insert_frame( internal, &slot->frame, txtb_id );
+        bool ok = false;
+        if ( txtb_id < internal->ntxbufs ) {
+          ok = ctucanfd_insert_frame( internal, &slot->frame, txtb_id );
+        }
         if ( ok == true ) {
           /* Frame inserted successfully, update TX buffer representation,
            * buffer priorities and set buffer as ready.