-
Notifications
You must be signed in to change notification settings - Fork 244
Description
Describe the bug
The cursor write function adding to m_used the amount that was written, without ensuring that the cursor is on the end of the used buffer:
erpc/erpc_c/infra/erpc_message_buffer.cpp
Line 156 in 932a8aa
m_buffer->setUsed(m_buffer->getUsed() + length); |
That may cause m_used to be even outside buffer boundaries (as it not checked in the setter function):
erpc/erpc_c/infra/erpc_message_buffer.h
Line 122 in 932a8aa
void setUsed(uint16_t used) { m_used = used; } |
And to send inner data outside:
erpc/erpc_c/infra/erpc_framed_transport.cpp
Line 110 in 932a8aa
messageLength = message->getUsed(); |
erpc/erpc_c/infra/erpc_framed_transport.cpp
Line 118 in 932a8aa
ret = underlyingSend(message->get(), messageLength); |
To Reproduce
Expected behavior
The minimum change is to ensure that the cursor is on the end of the used data. but if that really what we want, we don't need cursor, just to add function called writeDataToEnd or such
Fix is related to #281 way to fix probably
Screenshots
Desktop (please complete the following information):
- OS:
- eRPC Version:v1.9.0
Steps you didn't forgot to do
- I checked if there is no related issue opened/closed.
- I checked that there doesn't exist opened PR which is solving this issue.
Additional context