Skip to content

Commit 3fb63c2

Browse files
chengkai15xiaoxiang781216
authored andcommitted
bluetooth: fix packet pointer may refer to null
rootcasue: when packet is null, packet var in for loop would refer to null memory. Signed-off-by: chengkai <[email protected]>
1 parent a55d62f commit 3fb63c2

File tree

1 file changed

+10
-6
lines changed

1 file changed

+10
-6
lines changed

drivers/wireless/bluetooth/bt_slip.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -777,6 +777,7 @@ static int bt_slip_receive(FAR struct bt_driver_s *drv,
777777
FAR uint8_t *packet;
778778
FAR uint8_t *cursor;
779779
FAR uint8_t *header;
780+
FAR uint8_t *pointer;
780781
uint8_t byte = 0;
781782
uint16_t checksum;
782783
size_t remaining;
@@ -818,13 +819,14 @@ static int bt_slip_receive(FAR struct bt_driver_s *drv,
818819
break;
819820
}
820821

821-
packet = bt_slip_unslip_byte(packet, &byte);
822-
if (!packet)
822+
pointer = bt_slip_unslip_byte(packet, &byte);
823+
if (!pointer)
823824
{
824825
state = PACKET_START;
825826
break;
826827
}
827828

829+
packet = pointer;
828830
*cursor++ = byte;
829831
remaining--;
830832

@@ -898,13 +900,14 @@ static int bt_slip_receive(FAR struct bt_driver_s *drv,
898900
break;
899901
case PACKET_PAYLOAD:
900902
{
901-
packet = bt_slip_unslip_byte(packet, &byte);
902-
if (!packet)
903+
pointer = bt_slip_unslip_byte(packet, &byte);
904+
if (!pointer)
903905
{
904906
state = PACKET_START;
905907
break;
906908
}
907909

910+
packet = pointer;
908911
*cursor++ = byte;
909912
remaining--;
910913

@@ -926,13 +929,14 @@ static int bt_slip_receive(FAR struct bt_driver_s *drv,
926929
break;
927930
case PACKET_DICHECK:
928931
{
929-
packet = bt_slip_unslip_byte(packet, &byte);
930-
if (!packet)
932+
pointer = bt_slip_unslip_byte(packet, &byte);
933+
if (!pointer)
931934
{
932935
state = PACKET_START;
933936
break;
934937
}
935938

939+
packet = pointer;
936940
*cursor++ = byte;
937941
remaining--;
938942

0 commit comments

Comments
 (0)