Mirror
/
ardupilot
mirror of https://github.com/ArduPilot/ardupilot
5
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

AP_Scripting: fixed bug in string logging with logger.write() 

this dereferenced a bad pointer, leading to crash and watchdog

thanks to Charlie for finding this!
This commit is contained in:
Andrew Tridgell 2021-10-06 09:51:21 +11:00 committed by Randy Mackay
parent 8b7f0081d2
commit c1c245f21b
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libraries/AP_Scripting/lua_bindings.cpp
View File

@ -9,6 +9,7 @@
#include <AP_Scripting/lua_generated_bindings.h> #include <AP_Scripting/lua_generated_bindings.h>
#include <AP_Scripting/AP_Scripting.h> #include <AP_Scripting/AP_Scripting.h>
#include <string.h>
extern const AP_HAL::HAL& hal; extern const AP_HAL::HAL& hal;
@ -261,10 +262,16 @@ static int AP_Logger_Write(lua_State *L) {
} }
if (charlen != 0) { if (charlen != 0) {
const char *tmp = luaL_checkstring(L, i); const char *tmp = luaL_checkstring(L, i);
if (strlen(tmp) > charlen) { const size_t slen = strlen(tmp);
if (slen > charlen) {
return luaL_error(L, "arg %i too long for %c format",i,fmt_cat[i-3]); return luaL_error(L, "arg %i too long for %c format",i,fmt_cat[i-3]);
} }
luaL_addlstring(&buffer, (char *)&tmp, charlen); char tstr[charlen];
memcpy(tstr, tmp, slen);
if (slen < charlen) {
memset(&tstr[slen], 0, charlen-slen);
}
luaL_addlstring(&buffer, tstr, charlen);
} }
} }