search

Cascoda / ca8210-linux

Linux kernel driver for direct SPI communication with Cascoda's CA-8210 IEEE 802.15.4 transceiver
BSD 3-Clause "New" or "Revised" License
5 stars 5 forks source link

potential memory corruption #7

Closed tjobanpu closed 7 years ago

tjobanpu commented 7 years ago

In the function ca8210_rx_done(), there is a check to see if the received packet is greater than the buffer that we have to hold the received packet, uint8_t buf[CA8210_SPI_BUF_SIZE]; if(len > CA8210_SPI_BUF_SIZE) {debug message} memcpy(buf,rx_final_buf,len);

Wont the above code cause memory corruption because buf cannot hold more than CA8210_SPI_BUF_SIZE ?

HarryMorris commented 7 years ago

You're absolutely right, I've pushed a commit to fix this problem:

if (len > CA8210_SPI_BUF_SIZE) {
    dev_crit(
        &priv->spi->dev,
        "Received packet len (%d) erroneously long\n",
        len
    );
    memset(
        priv->cas_ctl.rx_final_buf,
        SPI_IDLE,
        CA8210_SPI_BUF_SIZE
    );
    spin_unlock_irqrestore(&priv->lock, flags);
    return;
}

Having never seen this occur I hadn't thought about safe recovery. Thanks for spotting it!