Open
Description
Description
In function setLedKey
, it fails to check col
properly
static inline void setLedKey(led_t *ledArray, const message_t *msg) {
uint8_t row = msg->payload[0];
uint8_t col = msg->payload[1];
led_t color = {.p.blue = msg->payload[2],
.p.green = msg->payload[3],
.p.red = msg->payload[4],
.p.alpha = msg->payload[5]};
naiveDimLed(&color);
if (row < NUM_ROW && col <= NUM_COLUMN) <--- oob
setKeyColor(&ledArray[ROWCOL2IDX(row, col)], color.rgb);
}
This leads to data corruption when setKeyColor
trying to write ledArray
at an out-of-bound offset, potentially causing DoS/RCE.
Fix
change col <= NUM_COLUMN
to col < NUM_COLUMN
Metadata
Assignees
Labels
No labels