From 9266b60029d66ad431be7e4268b2721d57e38063 Mon Sep 17 00:00:00 2001 From: Adrian Del Grosso <10929341+ad3154@users.noreply.github.com> Date: Tue, 23 May 2023 11:29:47 -0500 Subject: [PATCH] [TP/ETP]: Fix an out of range vector access --- isobus/src/can_extended_transport_protocol.cpp | 2 +- isobus/src/can_transport_protocol.cpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/isobus/src/can_extended_transport_protocol.cpp b/isobus/src/can_extended_transport_protocol.cpp index edf78506..0df424c8 100644 --- a/isobus/src/can_extended_transport_protocol.cpp +++ b/isobus/src/can_extended_transport_protocol.cpp @@ -297,7 +297,7 @@ namespace isobus (StateMachineState::RxDataSession == tempSession->state) && (messageData[SEQUENCE_NUMBER_DATA_INDEX] == (tempSession->lastPacketNumber + 1))) { - for (std::uint8_t i = SEQUENCE_NUMBER_DATA_INDEX; i < PROTOCOL_BYTES_PER_FRAME; i++) + for (std::uint8_t i = SEQUENCE_NUMBER_DATA_INDEX; (i < PROTOCOL_BYTES_PER_FRAME) && ((PROTOCOL_BYTES_PER_FRAME * tempSession->lastPacketNumber) + i < tempSession->get_message_data_length()); i++) { std::uint32_t currentDataIndex = (PROTOCOL_BYTES_PER_FRAME * tempSession->processedPacketsThisSession) + i; tempSession->sessionMessage.set_data(messageData[1 + SEQUENCE_NUMBER_DATA_INDEX + i], currentDataIndex); diff --git a/isobus/src/can_transport_protocol.cpp b/isobus/src/can_transport_protocol.cpp index 4c9de195..96a95492 100644 --- a/isobus/src/can_transport_protocol.cpp +++ b/isobus/src/can_transport_protocol.cpp @@ -284,7 +284,7 @@ namespace isobus // Check for valid sequence number if (message.get_data()[SEQUENCE_NUMBER_DATA_INDEX] == (tempSession->lastPacketNumber + 1)) { - for (std::uint8_t i = SEQUENCE_NUMBER_DATA_INDEX; i < PROTOCOL_BYTES_PER_FRAME; i++) + for (std::uint8_t i = SEQUENCE_NUMBER_DATA_INDEX; (i < PROTOCOL_BYTES_PER_FRAME) && ((PROTOCOL_BYTES_PER_FRAME * tempSession->lastPacketNumber) + i < tempSession->get_message_data_length()); i++) { std::uint16_t currentDataIndex = (PROTOCOL_BYTES_PER_FRAME * tempSession->lastPacketNumber) + i; tempSession->sessionMessage.set_data(message.get_data()[1 + SEQUENCE_NUMBER_DATA_INDEX + i], currentDataIndex);