dark0707
/
px4-firmware
forked from Archive/PX4-Autopilot
1
0
Fork 0
Code Pull Requests Activity

px4io: fix array regs[] size (#14135) 

may cause memory override if _max_controls larger then _max_actuators
This commit is contained in:
BazookaJoe1900 2020-02-13 14:01:12 +02:00 committed by GitHub
parent 5e3796324c
commit c78572b471
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/drivers/px4io/px4io.cpp
View File

@ -1306,9 +1306,9 @@ PX4IO::io_set_control_state(unsigned group)
controls.control[3] = 1.0f; controls.control[3] = 1.0f;
} }
uint16_t regs[_max_actuators]; uint16_t regs[sizeof(controls.control) / sizeof(controls.control[0])] = {};
for (unsigned i = 0; i < _max_controls; i++) { for (unsigned i = 0; (i < _max_controls) && (i < sizeof(controls.control) / sizeof(controls.control[0])); i++) {
/* ensure FLOAT_TO_REG does not produce an integer overflow */ /* ensure FLOAT_TO_REG does not produce an integer overflow */
const float ctrl = math::constrain(controls.control[i], -1.0f, 1.0f); const float ctrl = math::constrain(controls.control[i], -1.0f, 1.0f);
@ -1319,12 +1319,12 @@ PX4IO::io_set_control_state(unsigned group)
regs[i] = FLOAT_TO_REG(ctrl); regs[i] = FLOAT_TO_REG(ctrl);
} }
} }
if (!_test_fmu_fail && !_motor_test.in_test_mode) { if (!_test_fmu_fail && !_motor_test.in_test_mode) {
/* copy values to registers in IO */ /* copy values to registers in IO */
return io_reg_set(PX4IO_PAGE_CONTROLS, group * PX4IO_PROTOCOL_MAX_CONTROL_COUNT, regs, _max_controls); return io_reg_set(PX4IO_PAGE_CONTROLS, group * PX4IO_PROTOCOL_MAX_CONTROL_COUNT, regs, math::min(_max_controls,
sizeof(controls.control) / sizeof(controls.control[0])));
} else { } else {
return OK; return OK;