Skip to content

common-hal/busio/UART.c could write past end of buffer #132

@dhalbert

Description

@dhalbert

https://github.com/adafruit/circuitpython/blob/master/atmel-samd/common-hal/busio/UART.c#L109 could write past the end of the buffer if buffer_end is already at the last slot in the buffer:

            uint32_t buffer_end = (self->buffer_start + self->buffer_size) % self->buffer_length;
            self->buffer[buffer_end] = received_data;
            self->buffer_size++;

            if (module->character_size == USART_CHARACTER_SIZE_9BIT) {
                /* 9-bit data, write next received byte to the buffer */
                self->buffer[buffer_end + 1] = (received_data >> 8);
                                   // ^^^ buffer_end + 1 could be out of bounds
                self->buffer_size++;
            }

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions