sergiotarxz/nuttx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merged in david_s5/nuttx/master_f7_i2c (pull request #774)

Browse Source 
stm32f7:i2c out of bounds access on priv->msgv

Error in if statment. It was checking for msgc > 0.
   If message count is 1, only index 0 is valid on
   priv->msgv. There for random values in memory were
   used to set next_norestart.

Approved-by: GregoryN <gnutt@nuttx.org>
This commit is contained in:
David Sidrane 2018-12-05 21:24:59 +00:00 committed by GregoryN
parent d830b323dd
commit f43451b7df
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
arch/arm/src/stm32f7/stm32_i2c.c
View File

@ -1464,7 +1464,9 @@ static inline void stm32_i2c_sendstart(FAR struct stm32_i2c_priv_s *priv)
* it otherwise.
*/
if (priv->msgc > 0)
/* Check if there are multiple messages and the next is a continuation */
if (priv->msgc > 1)
{
next_norestart = (((priv->msgv + 1)->flags & I2C_M_NOSTART) != 0);
}