Fix buffer overflow in the cc26x0-cc13x0 BMP280 sensor driver
The calibration data structure's size is 28 bytes, but we were only allocating 24 bytes for the buffer used for calibration I2C transactions. I2C transactions would write 4 bytes beyond the end of the buffer.
/*---------------------------------------------------------------------------*/
/* Misc. */
#define MEAS_DATA_SIZE 6
-#define CALIB_DATA_SIZE 24
/*---------------------------------------------------------------------------*/
#define RES_OFF 0
#define RES_ULTRA_LOW_POWER 1
@@ -120,8 +119,8 @@ typedef struct bmp_280_calibration {
int16_t dig_p9;
int32_t t_fine;
} bmp_280_calibration_t;
-/*---------------------------------------------------------------------------*/
-static uint8_t calibration_data[CALIB_DATA_SIZE];
+
+static bmp_280_calibration_t calibration_data;
/*---------------------------------------------------------------------------*/
#define SENSOR_STATUS_DISABLED 0
#define SENSOR_STATUS_INITIALISED 1
@@ -165,7 +164,8 @@ init(void)
select_on_bus();
/* Read and store calibration data */
- sensor_common_read_reg(ADDR_CALIB, calibration_data, CALIB_DATA_SIZE);
+ sensor_common_read_reg(ADDR_CALIB, (uint8_t *)&calibration_data,
+ sizeof(calibration_data));
/* Reset the sensor */
val = VAL_RESET_EXECUTE;
@@ -227,7 +227,7 @@ static void
convert(uint8_t *data, int32_t *temp, uint32_t *press)
{
int32_t utemp, upress;
- bmp_280_calibration_t *p = (bmp_280_calibration_t *)calibration_data;
+ bmp_280_calibration_t *p = &calibration_data;
int32_t v_x1_u32r;
int32_t v_x2_u32r;
int32_t temperature;
