michaelh/zephyr
1
0
Fork 0
Code Releases Activity

drivers: modem: hl7800: fix potential buffer overrrun

Browse source 
Correct destination buffer size when processing
RX messages from modem.

Signed-off-by: Ryan Erickson <ryan.erickson@lairdconnect.com>
This commit is contained in:
Ryan Erickson 2021-05-04 12:40:41 -05:00 • committed by Kumar Gala
commit c9b8f89b80
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/modem/hl7800.c
View file

@ -1541,7 +1541,7 @@ static bool on_cmd_atcmdinfo_ipaddr(struct net_buf **buf, uint16_t len)
char gw_str[NET_IPV4_ADDR_LEN]; char gw_str[NET_IPV4_ADDR_LEN];
int dns_len; int dns_len;
out_len = net_buf_linearize(value, len, *buf, 0, len); out_len = net_buf_linearize(value, sizeof(value), *buf, 0, len);
value[out_len] = 0; value[out_len] = 0;
search_start = value; search_start = value;
@ -1660,7 +1660,7 @@ static bool on_cmd_atcmdinfo_operator_status(struct net_buf **buf, uint16_t len)
char *search_start; char *search_start;
int i; int i;
out_len = net_buf_linearize(value, len, *buf, 0, len); out_len = net_buf_linearize(value, sizeof(value), *buf, 0, len);
value[out_len] = 0; value[out_len] = 0;
LOG_INF("Operator: %s", log_strdup(value)); LOG_INF("Operator: %s", log_strdup(value));
@ -2548,7 +2548,7 @@ static bool on_cmd_sock_ind(struct net_buf **buf, uint16_t len)
ictx.last_error = 0; ictx.last_error = 0;
out_len = net_buf_linearize(value, len, *buf, 0, len); out_len = net_buf_linearize(value, sizeof(value), *buf, 0, len);
value[out_len] = 0; value[out_len] = 0;
/* find ',' because this is the format we expect */ /* find ',' because this is the format we expect */
@ -2601,7 +2601,7 @@ static bool on_cmd_sock_error_code(struct net_buf **buf, uint16_t len)
char value[MDM_MAX_RESP_SIZE]; char value[MDM_MAX_RESP_SIZE];
size_t out_len; size_t out_len;
out_len = net_buf_linearize(value, len, *buf, 0, len); out_len = net_buf_linearize(value, sizeof(value), *buf, 0, len);
value[out_len] = 0; value[out_len] = 0;
LOG_ERR("Error code: %s", log_strdup(value)); LOG_ERR("Error code: %s", log_strdup(value));
@ -2654,7 +2654,7 @@ static bool on_cmd_sock_notif(struct net_buf **buf, uint16_t len)
bool trigger_sem = true; bool trigger_sem = true;
int id; int id;
out_len = net_buf_linearize(value, len, *buf, 0, len); out_len = net_buf_linearize(value, sizeof(value), *buf, 0, len);
value[out_len] = 0; value[out_len] = 0;
/* find ',' because this is the format we expect */ /* find ',' because this is the format we expect */
@ -2716,7 +2716,7 @@ static bool on_cmd_sockcreate(struct net_buf **buf, uint16_t len)
char value[MDM_MAX_RESP_SIZE]; char value[MDM_MAX_RESP_SIZE];
struct hl7800_socket *sock = NULL; struct hl7800_socket *sock = NULL;
out_len = net_buf_linearize(value, len, *buf, 0, len); out_len = net_buf_linearize(value, sizeof(value), *buf, 0, len);
value[out_len] = 0; value[out_len] = 0;
ictx.last_socket_id = strtol(value, NULL, 10); ictx.last_socket_id = strtol(value, NULL, 10);
LOG_DBG("+K**PCFG: %d", ictx.last_socket_id); LOG_DBG("+K**PCFG: %d", ictx.last_socket_id);