michaelh/zephyr
1
0
Fork 0
Code Releases Activity

subsys/mgmt: Fix incorrect buffer space check

Browse source 
zephyr_smp_write_at is supposed to write len bytes of data at
the offset of a given net_buf, overwriting existing data and extending
beyond current buffer length, if needed. Unfortunately condition
checking if written data would fit within the buffer size has been
incorrectly implemented, making write impossible, when there has been
less bytes of space left within buffer tailroom than required to write
len bytes of data, even if len bytes written starting at given offset
would not cross the buffer boundary.

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
This commit is contained in:
Dominik Ermel 2020-02-24 13:50:35 +00:00 • committed by Johan Hedberg
commit d09009d7c5
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
subsys/mgmt/smp.c
View file

@ -148,7 +148,7 @@ zephyr_smp_write_at(struct cbor_encoder_writer *writer, size_t offset,
return MGMT_ERR_EINVAL;
}
if (len > net_buf_tailroom(nb)) {
if ((offset + len) > (nb->size - net_buf_headroom(nb))) {
return MGMT_ERR_EINVAL;
}