rooty/LibrePilot
1
0
Fork 0
mirror of https://bitbucket.org/librepilot/librepilot.git synced 2025-01-29 14:52:12 +01:00
Code Issues Releases Activity

LP-625 Fix for unsafe use of temporary data

Browse Source
This commit is contained in:
Vladimir Zidar 2022-06-12 23:24:26 +02:00
parent 42c14a2a0b
commit ab1a825417
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ground/gcs/src/plugins/flightlog/flightlogmanager.cpp
View File

@ -229,15 +229,16 @@ void FlightLogManager::retrieveLogs(int flightToRetrieve)
// cycle until there is space for another object
while (start + header_len + 1 < data_len) {
memset(&fields, 0xFF, total_len);
uint8_t *tmp = logEntry->getData().Data; // avoid compiler warning regarding addressing a temporary make sure tmp lives until after memcpy
memcpy(&fields, &tmp[start], header_len);
ExtendedDebugLogEntry::DataFields tmp = logEntry->getData();
memcpy(&fields, &tmp.Data[start], header_len);
// check wether a packed object is found
// note that empty data blocks are set as 0xFF in flight side to minimize flash wearing
// thus as soon as this read outside of used area, the test will fail as lenght would be 0xFFFF
quint32 toread = header_len + fields.Size;
if (!(toread + start > data_len)) {
uint8_t *tmp = logEntry->getData().Data; // avoid compiler warning regarding addressing a temporary make sure tmp lives until after memcpy
memcpy(&fields, &tmp[start], toread);
tmp = logEntry->getData();
memcpy(&fields, &tmp.Data[start], toread);
ExtendedDebugLogEntry *subEntry = new ExtendedDebugLogEntry();
subEntry->setData(fields, m_objectManager);
m_logEntries << subEntry;