r2axz / bluepill-serial-monster

USB to 3 Port Serial (UART) adapter firmware for STM32 Blue Pill.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Possible buffer overflow in the 7-bits data mode

vnodeng opened this issue · comments

The code in the usb_cdc.c:usb_cdc_port_send_rx_usb() function looks a little bit suspicious: in the 7-bits data mode it clears MSB of received data in the circular buffer treating it as linear buffer. Since the amount of affected bytes calculated as total number of bytes stored, this may lead buf_ptr pointer to run out of circular buffer bounds.

Hi,

Looks like it does, thanks for pointing this out. 7-bit mode is somewhat limited in bluebill-serial-monster. For instance, it can only work when the parity bit is enabled due to the hardware limitations. I've never actually properly tested this mode other than playing with it in terminal software. Will take a closer look into this in a couple of days.