fly316/PX4-Autopilot
7
0
Fork 0
mirror of https://gitee.com/mirrors_PX4/PX4-Autopilot.git synced 2026-05-22 12:57:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

dataman: Prevent database corruption

Browse Source 
The size in g_per_item_size[item] is the real struct size
+ DM_SECTOR_HDR_SIZE bytes of header and the backend functions were
not taking in care it. So a call to dm_write() with more bytes than
the real struct is allowed, causing corruption in the header of the
next item.

Kudos to jeonghwan-lee for finding it. https://github.com/PX4/Firmware/issues/7927
This commit is contained in:
José Roberto de Souza
2017-10-16 11:02:03 -07:00
committed by Lorenz Meier
parent cc724438f9
commit 239de7191f
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/modules/dataman/dataman.cpp
+4 -4
View File
@@ -470,7 +470,7 @@ static ssize_t _ram_write(dm_item_t item, unsigned index, dm_persitence_t persis
}
/* Make sure caller has not given us more data than we can handle */
if (count > g_per_item_size[item]) {
if (count > (g_per_item_size[item] - DM_SECTOR_HDR_SIZE)) {
return -E2BIG;
}
@@ -511,7 +511,7 @@ _file_write(dm_item_t item, unsigned index, dm_persitence_t persistence, const v
}
/* Make sure caller has not given us more data than we can handle */
if (count > g_per_item_size[item]) {
if (count > (g_per_item_size[item] - DM_SECTOR_HDR_SIZE)) {
return -E2BIG;
}
@@ -581,7 +581,7 @@ static ssize_t _ram_read(dm_item_t item, unsigned index, void *buf, size_t count
}
/* Make sure the caller hasn't asked for more data than we can handle */
if (count > g_per_item_size[item]) {
if (count > (g_per_item_size[item] - DM_SECTOR_HDR_SIZE)) {
return -E2BIG;
}
@@ -624,7 +624,7 @@ _file_read(dm_item_t item, unsigned index, void *buf, size_t count)
}
/* Make sure the caller hasn't asked for more data than we can handle */
if (count > g_per_item_size[item]) {
if (count > (g_per_item_size[item] - DM_SECTOR_HDR_SIZE)) {
return -E2BIG;
}