fly316/PX4-Autopilot
7
0
Fork 0
mirror of https://gitee.com/mirrors_PX4/PX4-Autopilot.git synced 2026-10-24 23:33:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

smbus: fix invalid memory access in read_word()

Browse Source 
read_word() expected 3 bytes (uint16_t + PEC byte), but was passed an
address to an uint16_t value.

write_word() is changed to be type-safe as well.
This commit is contained in:
Beat Küng
2019-11-07 10:56:27 +01:00
parent e772ddf012
commit 32359168d6
3 changed files with 44 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/drivers/smbus/SMBus.cpp
+13 -13
View File
@@ -50,23 +50,23 @@ SMBus::SMBus(int bus_num, uint16_t address) :
{
}
int SMBus::read_word(const uint8_t cmd_code, void *data)
int SMBus::read_word(const uint8_t cmd_code, uint16_t &data)
{
uint8_t buf[6];
// 2 data bytes + pec byte
int result = transfer(&cmd_code, 1, (uint8_t *)data, 3);
int result = transfer(&cmd_code, 1, buf + 3, 3);
if (result == PX4_OK) {
data = buf[3] | ((uint16_t)buf[4] << 8);
// Check PEC.
uint8_t addr = get_device_address() << 1;
uint8_t full_data_packet[5];
full_data_packet[0] = addr | 0x00;
full_data_packet[1] = cmd_code;
full_data_packet[2] = addr | 0x01;
memcpy(&full_data_packet[3], data, 2);
buf[0] = addr | 0x00;
buf[1] = cmd_code;
buf[2] = addr | 0x01;
uint8_t pec = get_pec(full_data_packet, sizeof(full_data_packet) / sizeof(full_data_packet[0]));
uint8_t pec = get_pec(buf, sizeof(buf) - 1);
if (pec != ((uint8_t *)data)[2]) {
if (pec != buf[sizeof(buf) - 1]) {
result = -EINVAL;
}
}
@@ -74,14 +74,14 @@ int SMBus::read_word(const uint8_t cmd_code, void *data)
return result;
}
int SMBus::write_word(const uint8_t cmd_code, void *data)
int SMBus::write_word(const uint8_t cmd_code, uint16_t data)
{
// 2 data bytes + pec byte
uint8_t buf[5] = {};
uint8_t buf[5];
buf[0] = (get_device_address() << 1) | 0x10;
buf[1] = cmd_code;
buf[2] = ((uint8_t *)data)[0];
buf[3] = ((uint8_t *)data)[1];
buf[2] = data & 0xff;
buf[3] = (data >> 8) & 0xff;
buf[4] = get_pec(buf, 4);