Skip to content

Commit

Permalink
dronecan: SocketCAN driver check size before copying
Browse files Browse the repository at this point in the history
Avoids memory corruption if we get packets to big
  • Loading branch information
PetervdPerk-NXP committed May 17, 2024
1 parent d359f62 commit 2d5af5e
Showing 1 changed file with 6 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -218,12 +218,18 @@ uavcan::int16_t CanIface::receive(uavcan::CanFrame &out_frame, uavcan::Monotonic
if (_can_fd) {
struct canfd_frame *recv_frame = (struct canfd_frame *)&_recv_frame;
out_frame.id = recv_frame->can_id;
if(recv_frame->len > CANFD_MAX_DLEN) {
return -EFAULT;
}
out_frame.dlc = recv_frame->len;
memcpy(out_frame.data, &recv_frame->data, recv_frame->len);

} else {
struct can_frame *recv_frame = (struct can_frame *)&_recv_frame;
out_frame.id = recv_frame->can_id;
if(recv_frame->can_dlc > CAN_MAX_DLEN) {
return -EFAULT;
}
out_frame.dlc = recv_frame->can_dlc;
memcpy(out_frame.data, &recv_frame->data, recv_frame->can_dlc);
}
Expand Down

0 comments on commit 2d5af5e

Please sign in to comment.