[bsp][nuvoton] Clamp CAN receive DLC - #11725
Open
Zepp-Hanzj wants to merge 1 commit into
Open
Conversation
|
👋 感谢您对 RT-Thread 的贡献!Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范,请在你的仓库中执行以下步骤运行代码格式化工作流(如果格式化CI运行失败)。 🛠 操作步骤 | Steps
完成后,提交将自动更新至 如有问题欢迎联系我们,再次感谢您的贡献!💐 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description / 描述
The nuvoton classic CAN drivers clamp the received DLC value from the hardware register in
nu_can_recvmsg(), preventing out-of-bounds read/write on the fixed-sizeData[8]buffer when the hardware reports an abnormal DLC (9~15).nuvoton 经典 CAN 驱动在
nu_can_recvmsg()中对来自硬件寄存器的接收 DLC 值做 clamp,防止当硬件报告异常 DLC(9~15)时对固定大小Data[8]缓冲区越界读写。Why / 为什么需要
pmsg->len = tMsg.DLC直接使用硬件寄存器值,随后rt_memcpy(pmsg->data, &tMsg.Data[0], pmsg->len)以该值作为拷贝长度。经典 CAN 的tMsg.Data和pmsg->data都是 8 字节,若 DLC > 8 会导致越界读(tMsg.Data)和越界写(pmsg->data)。发送侧nu_can_sendmsg已用IS_CAN_DLC(len) <= 8U校验,接收侧却缺失,不对称。How / 修改了哪些文件
bsp/nuvoton/libraries/m2354/rtt_port/drv_can.c: clamp DLC tosizeof(tMsg.Data)bsp/nuvoton/libraries/m480/rtt_port/drv_can.c: clamp DLC tosizeof(tMsg.Data)bsp/nuvoton/libraries/n9h30/rtt_port/drv_can.c: clamp DLC tosizeof(tMsg.Data)bsp/nuvoton/libraries/nuc980/rtt_port/drv_can.c: clamp DLC tosizeof(tMsg.Data)This fix mirrors the previously merged
[bsp][loongson] Clamp CAN receive DLCchange.