Mirror/inav
1
0
Fork 0
mirror of https://github.com/iNavFlight/inav.git synced 2025-07-26 09:45:33 +03:00
Code Issues Wiki Activity

Merge pull request #9407 from iNavFlight/dzikuvx-fix-jeti-buffer-overflow

Browse source 
Fix JETI EXBUS overflow
This commit is contained in:
Paweł Spychalski 2023-10-26 11:06:51 +02:00 • committed by GitHub
commit 183e1e5eb9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/main/rx/jetiexbus.c
View file

@ -158,6 +158,7 @@ static void jetiExBusDataReceive(uint16_t c, void *data)
static timeUs_t jetiExBusTimeLast = 0; static timeUs_t jetiExBusTimeLast = 0;
static uint8_t *jetiExBusFrame; static uint8_t *jetiExBusFrame;
static uint8_t jetiExBusFrameMaxSize;
const timeUs_t now = microsISR(); const timeUs_t now = microsISR();
// Check if we shall reset frame position due to time // Check if we shall reset frame position due to time
@ -174,11 +175,13 @@ static void jetiExBusDataReceive(uint16_t c, void *data)
case EXBUS_START_CHANNEL_FRAME: case EXBUS_START_CHANNEL_FRAME:
jetiExBusFrameState = EXBUS_STATE_IN_PROGRESS; jetiExBusFrameState = EXBUS_STATE_IN_PROGRESS;
jetiExBusFrame = jetiExBusChannelFrame; jetiExBusFrame = jetiExBusChannelFrame;
jetiExBusFrameMaxSize = EXBUS_MAX_CHANNEL_FRAME_SIZE;
break; break;
case EXBUS_START_REQUEST_FRAME: case EXBUS_START_REQUEST_FRAME:
jetiExBusRequestState = EXBUS_STATE_IN_PROGRESS; jetiExBusRequestState = EXBUS_STATE_IN_PROGRESS;
jetiExBusFrame = jetiExBusRequestFrame; jetiExBusFrame = jetiExBusRequestFrame;
jetiExBusFrameMaxSize = EXBUS_MAX_CHANNEL_FRAME_SIZE;
break; break;
default: default:
@ -186,6 +189,15 @@ static void jetiExBusDataReceive(uint16_t c, void *data)
} }
} }
if (jetiExBusFramePosition == jetiExBusFrameMaxSize) {
// frame overrun
jetiExBusFrameReset();
jetiExBusFrameState = EXBUS_STATE_ZERO;
jetiExBusRequestState = EXBUS_STATE_ZERO;
return;
}
// Store in frame copy // Store in frame copy
jetiExBusFrame[jetiExBusFramePosition] = (uint8_t)c; jetiExBusFrame[jetiExBusFramePosition] = (uint8_t)c;
jetiExBusFramePosition++; jetiExBusFramePosition++;