OrgApache/incubator-nuttx
OrgApache
/
incubator-nuttx
mirror of https://github.com/apache/incubator-nuttx.git
1
0
Fork 0
Code Issues Releases Wiki Activity

rpmsg_ping.c: fix msg data memset length 

The range of memset exceeds the size of the buffer

Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
This commit is contained in:
Yongrong Wang 2024-07-23 11:15:16 +08:00 committed by GUIDINGLI
parent 4b77dd03db
commit 976c4173f0
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/rpmsg/rpmsg_ping.c
View File

@ -101,8 +101,6 @@ static int rpmsg_ping_ept_cb(FAR struct rpmsg_endpoint *ept,
i, data_len);
break;
}
msg->data[i] = 0;
}
}
@ -132,9 +130,6 @@ static int rpmsg_ping_once(FAR struct rpmsg_endpoint *ept, int len,
return -ENOMEM;
}
len = MAX(len, sizeof(struct rpmsg_ping_msg_s));
len = MIN(len, *buf_len);
msg->cmd = cmd;
if ((msg->cmd & RPMSG_PING_RANDOMLEN_MASK) != 0)
@ -146,13 +141,16 @@ static int rpmsg_ping_once(FAR struct rpmsg_endpoint *ept, int len,
msg->len = len;
}
msg->len = MAX(msg->len, sizeof(struct rpmsg_ping_msg_s));
msg->len = MIN(msg->len, *buf_len);
if ((msg->cmd & RPMSG_PING_CHECK_MASK) != 0)
{
memset(msg->data, i, msg->len - sizeof(struct rpmsg_ping_msg_s) + 1);
}
else
{
memset(msg->data, 0, msg->len);
memset(msg->data, 0, msg->len - sizeof(struct rpmsg_ping_msg_s) + 1);
}
if ((msg->cmd & RPMSG_PING_ACK_MASK) != 0)