Commit 9c6e6d78 authored by Jordan Yates's avatar Jordan Yates Committed by Dan Kalowsky
Browse files

drivers: lora: rylrxxx: fix `snprintf` usage 



The second argument should unconditionally be the size of the output
memory area, not computationally derived from the input payload length.
The previous length validations would be incorrect when
`cmd_len == CONFIG_LORA_RYLRXX_CMD_BUF_SIZE`, as `snprintf` would be
told the output buffer was `CONFIG_LORA_RYLRXX_CMD_BUF_SIZE + 1` bytes
long.

Fixes #92619
Fixes #92624

Signed-off-by: default avatarJordan Yates <jordan@embeint.com>
parent ec80ab5b

drivers/lora/rylrxxx.c

+9 −6
Original line number Diff line number Diff line
@@ -390,13 +390,15 @@ int rylr_send(const struct device *dev, uint8_t *payload, uint32_t payload_len) 
		goto exit;

	}



	if (cmd_len > CONFIG_LORA_RYLRXX_CMD_BUF_SIZE) {

	/* snprintf requires an extra byte for the terminating NULL */

	if (cmd_len > (CONFIG_LORA_RYLRXX_CMD_BUF_SIZE - 1)) {

		LOG_ERR("payload too long");

		err = -EINVAL;

		goto exit;

	}



	snprintf(data->cmd_buffer, cmd_len + 1, RYLR_CMD_SEND_FORMAT, payload_len, payload);

	snprintf(data->cmd_buffer, sizeof(data->cmd_buffer), RYLR_CMD_SEND_FORMAT, payload_len,

		 payload);

	data->curr_cmd_len = cmd_len;

	err = rylr_send_cmd_buffer(dev);

	if (err != 0) {
@@ -437,7 +439,8 @@ int rylr_send_async(const struct device *dev, uint8_t *payload, uint32_t payload 
	}



	cmd_len = RYLR_CMD_SEND_LENGTH(payload_len);

	if (cmd_len > CONFIG_LORA_RYLRXX_CMD_BUF_SIZE) {

	/* snprintf requires an extra byte for the terminating NULL */

	if (cmd_len > (CONFIG_LORA_RYLRXX_CMD_BUF_SIZE - 1)) {

		LOG_ERR("payload too long");

		err = -EINVAL;

		goto bail;
@@ -450,8 +453,8 @@ int rylr_send_async(const struct device *dev, uint8_t *payload, uint32_t payload 
	}



	data->async_tx_signal = async;

	data->curr_cmd_len =

		snprintf(data->cmd_buffer, cmd_len + 1, RYLR_CMD_SEND_FORMAT, payload_len, payload);

	data->curr_cmd_len = snprintf(data->cmd_buffer, sizeof(data->cmd_buffer),

				      RYLR_CMD_SEND_FORMAT, payload_len, payload);

	rylr_reset_dynamic_script(data);

	data->dynamic_chat.request = data->cmd_buffer;

	data->dynamic_chat.request_size = data->curr_cmd_len;

CRA Git | Maintained and supported by SUSTech CRA and CCSE