dani/CommandStation-EX
1
0
Fork 0
mirror of https://github.com/DCC-EX/CommandStation-EX.git synced 2025-02-23 00:56:03 +01:00
Code Releases Activity

Bugfix: serial COMMAND_BUFFER_SIZE could be silently overrun

Browse Source
This commit is contained in:
Harald Barth 2025-01-31 11:17:59 +01:00
parent 9054d8d9f5
commit 0154e7fd78
1 changed files with 27 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
SerialManager.cpp
View File

@ -126,8 +126,8 @@ void SerialManager::loop2() {
buffer[0] = '\0'; buffer[0] = '\0';
} }
} else { // if (inCommandPayload) } else { // if (inCommandPayload)
if (bufferLength < (COMMAND_BUFFER_SIZE-1)) if (bufferLength < (COMMAND_BUFFER_SIZE-1)) {
buffer[bufferLength++] = ch; buffer[bufferLength++] = ch; // advance bufferLength
if (inCommandPayload > PAYLOAD_NORMAL) { if (inCommandPayload > PAYLOAD_NORMAL) {
if (inCommandPayload > 32 + 2) { // String way too long if (inCommandPayload > 32 + 2) { // String way too long
ch = '>'; // we end this nonsense ch = '>'; // we end this nonsense
@ -142,14 +142,18 @@ void SerialManager::loop2() {
} }
if (inCommandPayload == PAYLOAD_NORMAL) { if (inCommandPayload == PAYLOAD_NORMAL) {
if (ch == '>') { if (ch == '>') {
buffer[bufferLength] = '\0'; buffer[bufferLength] = '\0'; // This \0 is after the '>'
DCCEXParser::parse(serial, buffer, NULL); DCCEXParser::parse(serial, buffer, NULL); // buffer parsed with trailing '>'
inCommandPayload = PAYLOAD_FALSE; inCommandPayload = PAYLOAD_FALSE;
break; break;
} else if (ch == '"') { } else if (ch == '"') {
inCommandPayload = PAYLOAD_STRING; inCommandPayload = PAYLOAD_STRING;
} }
} }
} else {
DIAG(F("Parse error: input buffer overflow"));
inCommandPayload = PAYLOAD_FALSE;
}
} }
} }
} }