michaelh/zephyr
1
0
Fork 0
Code Releases Activity

drivers: winc1500: Fix signed/unsigned comparison

Browse source 
The value from socket() was directly assigned to offload_context, which
was treated as a unsigned integer when compared. This prevented the
following if statement from catching any errors, leading to random RAM
access. This is fixed by using an intermediate with the same type as the
return value, which is then assigned to offload_context after error
checking.

Signed-off-by: Abram Early <abram.early@gmail.com>
This commit is contained in:
Abram Early 2020-09-02 13:36:51 -06:00 • committed by Maureen Helm
commit c7cec489de
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/wifi/winc1500/wifi_winc1500.c
View file

@ -298,19 +298,21 @@ static int winc1500_get(sa_family_t family,
struct net_context **context) struct net_context **context)
{ {
struct socket_data *sd; struct socket_data *sd;
SOCKET sock;
if (family != AF_INET) { if (family != AF_INET) {
LOG_ERR("Only AF_INET is supported!"); LOG_ERR("Only AF_INET is supported!");
return -1; return -1;
} }
(*context)->offload_context = (void *)(sint32)socket(family, type, 0); sock = socket(family, type, 0);
if ((*context)->offload_context < 0) { if (sock < 0) {
LOG_ERR("socket error!"); LOG_ERR("socket error!");
return -1; return -1;
} }
sd = &w1500_data.socket_data[(int)(*context)->offload_context]; (*context)->offload_context = (void *)(intptr_t)sock;
sd = &w1500_data.socket_data[sock];
k_sem_init(&sd->wait_sem, 0, 1); k_sem_init(&sd->wait_sem, 0, 1);