newtmgr; crashes with invalid nh_len. Fix by removing ability to
handle multiple incoming requests in a single message, as that is
not being used.
@@ -188,8 +188,6 @@ nmgr_handle_req(struct nmgr_transport *nt, struct os_mbuf *req)
CborEncoder payload_enc;
struct nmgr_hdr *rsp_hdr;
struct nmgr_hdr hdr;
- int off;
- uint16_t len;
uint16_t mtu;
int rc;
@@ -215,11 +213,7 @@ nmgr_handle_req(struct nmgr_transport *nt, struct os_mbuf *req)
/* Copy the request user header into the response. */
memcpy(OS_MBUF_USRHDR(rsp), OS_MBUF_USRHDR(req), OS_MBUF_USRHDR_LEN(req));
- off = 0;
- len = OS_MBUF_PKTHDR(req)->omp_len;
-
- while (off < len) {
- rc = os_mbuf_copydata(req, off, sizeof(hdr), &hdr);
+ rc = os_mbuf_copydata(req, 0, sizeof(hdr), &hdr);
if (rc < 0) {
rc = MGMT_ERR_EINVAL;
goto err_norsp;
@@ -283,8 +277,7 @@ nmgr_handle_req(struct nmgr_transport *nt, struct os_mbuf *req)
goto err;
}
- rsp_hdr->nh_len +=
- cbor_encode_bytes_written(&nmgr_task_cbuf.n_b.encoder);
+ rsp_hdr->nh_len += cbor_encode_bytes_written(&nmgr_task_cbuf.n_b.encoder);
rsp_hdr->nh_len = htons(rsp_hdr->nh_len);
rc = nmgr_rsp_tx(nt, &rsp, mtu);
@@ -299,9 +292,6 @@ nmgr_handle_req(struct nmgr_transport *nt, struct os_mbuf *req)
}
}
- off += sizeof(hdr) + OS_ALIGN(hdr.nh_len, 4);
- }
-
os_mbuf_free_chain(rsp);
os_mbuf_free_chain(req);
return;
