Michel2/Tasmota
1
0 Fork 0
mirror of https://github.com/arendst/Tasmota.git synced 2026-10-26 22:11:22 +00:00
Code Issues Releases Activity

Fix buffer overflow

Browse Source
This commit is contained in:
Theo Arends committed 2026-10-16 10:54:42 +02:00
1 parent a0ff1cdc57
commit db29ff1f17
1 file changed
+8 -2
Download Patch File Download Diff File Expand all files Collapse all files
tasmota/tasmota_xsns_sensor/xsns_87_can_sniffer.ino
+8 -2
View File
@@ -88,11 +88,17 @@ void CmndCan(void) {
}
void CmndCanSend(void) {
// CanSend {"ID":12345,"LEN":8,"DATA":[11,22,33,44,55,66,77,88]}
if (XdrvMailbox.data_len > 64) { return; } // Any data too long
JsonParser parser(XdrvMailbox.data);
JsonParserObject root = parser.getRootObject();
uint16_t id = root.getUInt(PSTR("ID"), 0); // case insensitive
uint16_t len = root.getUInt(PSTR("LEN"), 0); // case insensitive
if (len > CAN_MAX_DLEN) { return; } // Too long
uint16_t id = root.getUInt(PSTR("ID"), 0); // case insensitive
JsonParserArray data = root[PSTR("DATA")];
struct can_frame canMsg;
@@ -100,7 +106,7 @@ void CmndCanSend(void) {
AddLog(LOG_LEVEL_INFO, PSTR("CAN: CanSend (%d)->%d"), id, len);
canMsg.can_id = id;
canMsg.can_dlc= len;
for (uint8_t i=0;i<len;i++) {
for (uint32_t i = 0; i < len; i++) {
canMsg.data[i] = data[i].getUInt();
AddLog(LOG_LEVEL_INFO, PSTR("CAN: CanSend data[%d]=%d"),i,data[i].getUInt());
}