michaelh/zephyr
1
0
Fork 0
Code Releases Activity

drivers: wifi: esp32: fix memmory corruption

Browse source 
Size of data pointer for event revival must be at least sizeof
event queue item.
Update to send whole event (id + event)

Signed-off-by: Pavlo Hamov <p.hamov@venstar.com>
This commit is contained in:
Pavlo Hamov 2021-10-11 19:36:09 +03:00 • committed by Anas Nashif
commit 18f26b843c
1 changed files with 15 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

19
drivers/wifi/esp32/src/esp_wifi_drv.c
View file

@ -54,7 +54,18 @@ esp_err_t esp_event_send_internal(esp_event_base_t event_base,
size_t event_data_size,
uint32_t ticks_to_wait)
{
k_msgq_put(&esp_wifi_msgq, (int32_t *)&event_id, K_FOREVER);
system_event_t evt = {
.event_id = event_id,
};
if (event_data_size > sizeof(evt.event_info)) {
LOG_ERR("MSG %d wont find %d > %d",
event_id, event_data_size, sizeof(evt.event_info));
return ESP_FAIL;
}
memcpy(&evt.event_info, event_data, event_data_size);
k_msgq_put(&esp_wifi_msgq, &evt, K_FOREVER);
return ESP_OK;
}
@ -111,12 +122,12 @@ pkt_unref:
static void esp_wifi_event_task(void)
{
int32_t event_id;
system_event_t evt;
while (1) {
k_msgq_get(&esp_wifi_msgq, &event_id, K_FOREVER);
k_msgq_get(&esp_wifi_msgq, &evt, K_FOREVER);
switch (event_id) {
switch (evt.event_id) {
case ESP32_WIFI_EVENT_STA_START:
LOG_INF("WIFI_EVENT_STA_START");
net_if_up(esp32_wifi_iface);