Skip to content

Commit

Permalink
fix OOB read bug in read_mailbox
Browse files Browse the repository at this point in the history
NOTE:
There was a bug with read_mailbox() where it would return all 8 bytes of
the frame, even if only a few of them were valid. If these bytes crossed
a word boundary (4 byte) - garbage data would be loaded from the mailbox
into the data frame.

For example, the can frame: 01#01 would cause the following output:
`[0x1, 0x0, 0x0, 0x0, ?, ?, ?, ?]`
Where `?` indicates an unknown value.
  • Loading branch information
sigil-03 committed Aug 14, 2024
1 parent 95ffd35 commit b360ab3
Showing 1 changed file with 11 additions and 2 deletions.
13 changes: 11 additions & 2 deletions src/common/can/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -850,6 +850,7 @@ impl<P, const M: u8> CAN<P, M> {
}

let code = self.read_mailbox_code(mailbox_number);
let cr = CodeReg::new(code);
let c = FlexCanMailboxCSCode::from_code_reg(code);

let mailbox_addr = self.mailbox_number_to_address(mailbox_number);
Expand All @@ -859,14 +860,22 @@ impl<P, const M: u8> CAN<P, M> {
c if c.is_tx_mailbox() => None,
// full or overrun
c if (c == FlexCanMailboxCSCode::RxFull) | (c == FlexCanMailboxCSCode::RxOverrun) => {
let dlc = cr.dlc();
let id =
unsafe { core::ptr::read_volatile((mailbox_addr + 0x4_u32) as *const u32) };
let data0 =
unsafe { core::ptr::read_volatile((mailbox_addr + 0x8_u32) as *const u32) };
let data1 =
unsafe { core::ptr::read_volatile((mailbox_addr + 0xC_u32) as *const u32) };
// Only valid if the DLC is > 4
let data1 = {
if dlc > 4 {
unsafe { core::ptr::read_volatile((mailbox_addr + 0xC_u32) as *const u32) }
} else {
0_u32
}
};

let mut data: [u8; 8] = [0, 0, 0, 0, 0, 0, 0, 0];

for i in 0..4 {
data[3 - i] = (data0 >> (8 * i)) as u8;
}
Expand Down

0 comments on commit b360ab3

Please sign in to comment.