atiran/sovereignx
3
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Null dereferencing fix

Browse source
This commit is contained in:
Eduardo Quezada 2023-09-22 11:23:27 -03:00
parent a56eb4f53f
commit 03a1e7779b
1 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/librfu_rfu.c
View file

@ -1430,7 +1430,11 @@ static u16 rfu_STC_setSendData_org(u8 ni_or_uni, u8 bmSendSlot, u8 subFrameSize,
else if (gRfuLinkStatus->parentChild == MODE_CHILD) else if (gRfuLinkStatus->parentChild == MODE_CHILD)
llFrameSize_p = &gRfuLinkStatus->remainLLFrameSizeChild[bm_slot_id]; llFrameSize_p = &gRfuLinkStatus->remainLLFrameSizeChild[bm_slot_id];
frameSize = llsf_struct[gRfuLinkStatus->parentChild].frameSize; frameSize = llsf_struct[gRfuLinkStatus->parentChild].frameSize;
#if UBFIX
if (llFrameSize_p && (subFrameSize > *llFrameSize_p || subFrameSize <= frameSize))
#else
if (subFrameSize > *llFrameSize_p || subFrameSize <= frameSize) if (subFrameSize > *llFrameSize_p || subFrameSize <= frameSize)
#endif
return ERR_SUBFRAME_SIZE; return ERR_SUBFRAME_SIZE;
imeBak = REG_IME; imeBak = REG_IME;
REG_IME = 0; REG_IME = 0;
@ -1468,7 +1472,10 @@ static u16 rfu_STC_setSendData_org(u8 ni_or_uni, u8 bmSendSlot, u8 subFrameSize,
} while (0); } while (0);
} }
gRfuLinkStatus->sendSlotNIFlag |= bmSendSlot; gRfuLinkStatus->sendSlotNIFlag |= bmSendSlot;
*llFrameSize_p -= subFrameSize; #if UBFIX
if (llFrameSize_p)
#endif
*llFrameSize_p -= subFrameSize;
slotStatus_NI->send.state = SLOT_STATE_SEND_START; slotStatus_NI->send.state = SLOT_STATE_SEND_START;
} }
else if (ni_or_uni & 0x10) else if (ni_or_uni & 0x10)
@ -1477,7 +1484,10 @@ static u16 rfu_STC_setSendData_org(u8 ni_or_uni, u8 bmSendSlot, u8 subFrameSize,
slotStatus_UNI->send.bmSlot = bmSendSlot; slotStatus_UNI->send.bmSlot = bmSendSlot;
slotStatus_UNI->send.src = src; slotStatus_UNI->send.src = src;
slotStatus_UNI->send.payloadSize = subFrameSize - frameSize; slotStatus_UNI->send.payloadSize = subFrameSize - frameSize;
*llFrameSize_p -= subFrameSize; #if UBFIX
if (llFrameSize_p)
#endif
*llFrameSize_p -= subFrameSize;
slotStatus_UNI->send.state = SLOT_STATE_SEND_UNI; slotStatus_UNI->send.state = SLOT_STATE_SEND_UNI;
gRfuLinkStatus->sendSlotUNIFlag |= bmSendSlot; gRfuLinkStatus->sendSlotUNIFlag |= bmSendSlot;
} }