atmel-samd: Fix potential buffer overflow in UART.c by recalculating

tannewt · tannewt · commit c82b84e0a925 · 2017-07-13T16:21:12.000-07:00
the buffer end rather than naively adding 1. It could have needed to wrap around. Thanks @dhalbert for spotting the bug. Fixes adafruit#132
diff --git a/atmel-samd/common-hal/busio/UART.c b/atmel-samd/common-hal/busio/UART.c
@@ -105,8 +105,9 @@ static void _busio_uart_interrupt_handler(uint8_t instance)
             self->buffer_size++;
 
             if (module->character_size == USART_CHARACTER_SIZE_9BIT) {
+                buffer_end = (self->buffer_start + self->buffer_size) % self->buffer_length;
                 /* 9-bit data, write next received byte to the buffer */
-                self->buffer[buffer_end + 1] = (received_data >> 8);
+                self->buffer[buffer_end] = (received_data >> 8);
                 self->buffer_size++;
             }
 

Original file line number	Diff line number	Diff line change
`@@ -105,8 +105,9 @@ static void _busio_uart_interrupt_handler(uint8_t instance)`
`105`	`105`	`self->buffer_size++;`
`106`	`106`
`107`	`107`	`if (module->character_size == USART_CHARACTER_SIZE_9BIT) {`
	`108`	`+ buffer_end = (self->buffer_start + self->buffer_size) % self->buffer_length;`
`108`	`109`	`/* 9-bit data, write next received byte to the buffer */`
`109`		`- self->buffer[buffer_end + 1] = (received_data >> 8);`
	`110`	`+ self->buffer[buffer_end] = (received_data >> 8);`
`110`	`111`	`self->buffer_size++;`
`111`	`112`	`}`
`112`	`113`