ARMmbed
/
mbed-os
mirror of https://github.com/ARMmbed/mbed-os.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

STM32: HAL smartcard, fix memory corruption in Receive 

Re-casting with tmp the uint8_t* pData pointer to uint16_t* brings a
memory corruption and typically can corrupt the size parameter. This
is fixed with this commit.

STM32 Internal ticket reference : 39116
pull/5505/head
Laurent MEUNIER 2017-11-15 10:50:21 +01:00
parent 1394bf95f1
commit be42c6de55
3 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
targets/TARGET_STM/TARGET_STM32F1/device/stm32f1xx_hal_smartcard.c
View File

@ -500,7 +500,6 @@ HAL_StatusTypeDef HAL_SMARTCARD_Transmit(SMARTCARD_HandleTypeDef *hsc, uint8_t *
*/ */
HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *pData, uint16_t Size, uint32_t Timeout) HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *pData, uint16_t Size, uint32_t Timeout)
{ {
uint16_t* tmp;
uint32_t tickstart = 0U; uint32_t tickstart = 0U;
if(hsc->RxState == HAL_SMARTCARD_STATE_READY) if(hsc->RxState == HAL_SMARTCARD_STATE_READY)
@ -530,8 +529,7 @@ HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *p
{ {
return HAL_TIMEOUT; return HAL_TIMEOUT;
} }
tmp = (uint16_t*) pData; *pData = (uint8_t)(hsc->Instance->DR & (uint8_t)0xFF);
*tmp = (uint8_t)(hsc->Instance->DR & (uint8_t)0xFF);
pData +=1U; pData +=1U;
} }

4
targets/TARGET_STM/TARGET_STM32F2/device/stm32f2xx_hal_smartcard.c
View File

@ -496,7 +496,6 @@ HAL_StatusTypeDef HAL_SMARTCARD_Transmit(SMARTCARD_HandleTypeDef *hsc, uint8_t *
*/ */
HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *pData, uint16_t Size, uint32_t Timeout) HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *pData, uint16_t Size, uint32_t Timeout)
{ {
uint16_t* tmp;
uint32_t tickstart = 0U; uint32_t tickstart = 0U;
if(hsc->RxState == HAL_SMARTCARD_STATE_READY) if(hsc->RxState == HAL_SMARTCARD_STATE_READY)
@ -526,8 +525,7 @@ HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *p
{ {
return HAL_TIMEOUT; return HAL_TIMEOUT;
} }
tmp = (uint16_t*) pData; *pData = (uint8_t)(hsc->Instance->DR & (uint8_t)0xFF);
*tmp = (uint8_t)(hsc->Instance->DR & (uint8_t)0xFF);
pData +=1U; pData +=1U;
} }

4
targets/TARGET_STM/TARGET_STM32F4/device/stm32f4xx_hal_smartcard.c
View File

@ -497,7 +497,6 @@ HAL_StatusTypeDef HAL_SMARTCARD_Transmit(SMARTCARD_HandleTypeDef *hsc, uint8_t *
*/ */
HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *pData, uint16_t Size, uint32_t Timeout) HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *pData, uint16_t Size, uint32_t Timeout)
{ {
uint16_t* tmp;
uint32_t tickstart = 0U; uint32_t tickstart = 0U;
if(hsc->RxState == HAL_SMARTCARD_STATE_READY) if(hsc->RxState == HAL_SMARTCARD_STATE_READY)
@ -527,8 +526,7 @@ HAL_StatusTypeDef HAL_SMARTCARD_Receive(SMARTCARD_HandleTypeDef *hsc, uint8_t *p
{ {
return HAL_TIMEOUT; return HAL_TIMEOUT;
} }
tmp = (uint16_t*) pData; *pData = (uint8_t)(hsc->Instance->DR & (uint8_t)0xFF);
*tmp = (uint8_t)(hsc->Instance->DR & (uint8_t)0xFF);
pData +=1U; pData +=1U;
} }