OpenAtomFoundation / TobudOS

开放原子开源基金会孵化的物联网操作系统,捐赠前为腾讯物联网终端操作系统TencentOS Tiny
https://cloud.tencent.com/product/tos-tiny
5.97k stars 1.61k forks source link

Fixed an array out-of-bounds issue caused by bubbling sort writing error #357

Closed fly1ngpengu1ns closed 1 year ago

fly1ngpengu1ns commented 1 year ago

在原本的代码中,当循环至j=9时,将访问到buf[10],但是在1063行对buf的定义:uint16_t buf[10];中得知访问buf[10]是一个数组越界访问行为,严重的话将会导致栈溢出漏洞。 而产生这个问题的原因在于,原本的冒泡排序的边界条件书写错误,将原本的错误条件:

for(i=0; i<10; i++){
    for(j=0; j<10; j++){
        // the code to swap
    }
}

更正为正确条件:

for(i=0; i<9; i++){
    for(j=0; j<9-i; j++){
        // the code to swap
    }
}

从而解决了这个问题

tencent-adm commented 1 year ago

CLA assistant check
Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

fly1ngpengu1ns commented 1 year ago

recheck

Supowang1989 commented 1 year ago

收到,这个是沁恒芯片的驱动代码,我跟对方工程师确定一下