Skip to content

Commit 7312715

Browse files
sudarsan-22kartben
authored andcommitted
drivers: sensor: fcx_mldx5: Fix potential buffer overflow in UART frame
Fix Coverity issue CID 363738 (CWE-120): A potential buffer overflow could occur in fcx_mldx5_uart_send() due to unchecked memcpy() when copying command data into a fixed-size frame buffer. This patch ensures that the length of the data being copied validated against the remaining buffer size to prevent overruns. Also replaces a redundant strlen() call with the precomputed cmd_data_len. Fixes: #92634 Signed-off-by: sudarsan N <[email protected]>
1 parent a022394 commit 7312715

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

drivers/sensor/fcx_mldx5/fcx_mldx5.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -235,8 +235,14 @@ static void fcx_mldx5_uart_send(const struct device *dev, enum fcx_mldx5_cmd cmd
235235

236236
buf[FCX_MLDX5_STX_INDEX] = FCX_MLDX5_STX;
237237
memcpy(&buf[FCX_MLDX5_CMD_INDEX], fcx_mldx5_cmds[cmd], FCX_MLDX5_CMD_LEN);
238-
if (cmd_data_len != 0 && cmd_data_len == fcx_mldx5_cmds_data_len[cmd]) {
239-
memcpy(&buf[FCX_MLDX5_DATA_INDEX], cmd_data, strlen(cmd_data));
238+
239+
if (cmd_data_len != 0) {
240+
if ((FCX_MLDX5_DATA_INDEX + cmd_data_len) <= FCX_MLDX5_MAX_FRAME_LEN) {
241+
memcpy(&buf[FCX_MLDX5_DATA_INDEX], cmd_data, cmd_data_len);
242+
} else {
243+
LOG_ERR("%s: cmd_data too large for buffer", __func__);
244+
return;
245+
}
240246
}
241247

242248
checksum = fcx_mldx5_calculate_checksum(&buf[FCX_MLDX5_CMD_INDEX],

0 commit comments

Comments
 (0)