forked from micropython/micropython
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Closed
Description
https://github.com/adafruit/circuitpython/blob/master/atmel-samd/common-hal/busio/UART.c#L109 could write past the end of the buffer if buffer_end
is already at the last slot in the buffer:
uint32_t buffer_end = (self->buffer_start + self->buffer_size) % self->buffer_length;
self->buffer[buffer_end] = received_data;
self->buffer_size++;
if (module->character_size == USART_CHARACTER_SIZE_9BIT) {
/* 9-bit data, write next received byte to the buffer */
self->buffer[buffer_end + 1] = (received_data >> 8);
// ^^^ buffer_end + 1 could be out of bounds
self->buffer_size++;
}
Metadata
Metadata
Assignees
Labels
No labels