From 521b89b1ce03079ab773e3d0a3959413b303f1b8 Mon Sep 17 00:00:00 2001 From: Lorenz Meier Date: Sat, 14 Jan 2017 14:31:17 +0100 Subject: [PATCH] MAVLink: Protect against illegal length indication of RTCM data --- src/modules/mavlink/mavlink_receiver.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/modules/mavlink/mavlink_receiver.cpp b/src/modules/mavlink/mavlink_receiver.cpp index 7c7cdeead6..9881f09272 100644 --- a/src/modules/mavlink/mavlink_receiver.cpp +++ b/src/modules/mavlink/mavlink_receiver.cpp @@ -1,6 +1,6 @@ /**************************************************************************** * - * Copyright (c) 2012-2015 PX4 Development Team. All rights reserved. + * Copyright (c) 2012-2017 PX4 Development Team. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -2005,10 +2005,11 @@ void MavlinkReceiver::handle_message_gps_rtcm_data(mavlink_message_t *msg) mavlink_msg_gps_rtcm_data_decode(msg, &gps_rtcm_data_msg); - gps_inject_data_topic.len = gps_rtcm_data_msg.len; + gps_inject_data_topic.len = math::min((int)sizeof(gps_rtcm_data_msg.data), + (int)sizeof(uint8_t) * gps_rtcm_data_msg.len); gps_inject_data_topic.flags = gps_rtcm_data_msg.flags; memcpy(gps_inject_data_topic.data, gps_rtcm_data_msg.data, - math::min((int)sizeof(gps_inject_data_topic.data), (int)sizeof(uint8_t) * gps_rtcm_data_msg.len)); + math::min((int)sizeof(gps_inject_data_topic.data), (int)sizeof(uint8_t) * gps_inject_data_topic.len)); orb_advert_t &pub = _gps_inject_data_pub;