Fix calculation of slice index
total_len is already rounded up, so the `+ 3` is not needed. And even if it was, the calculation should have been `((total_len + 3) / 4)`. `(total_len + 3 / 4)` is equivalent to `total_len` and can overflow the slice, leading to a panic which can easily be triggered by sending large ICMP ECHO packets to the device.
This commit is contained in:
		
							parent
							
								
									69e92e5639
								
							
						
					
					
						commit
						acaa8b3e8b
					
				@ -762,7 +762,7 @@ where
 | 
			
		||||
                let bus = unsafe { &mut *bus };
 | 
			
		||||
                async {
 | 
			
		||||
                    bus.write(&[cmd]).await?;
 | 
			
		||||
                    bus.write(&buf[..(total_len + 3 / 4)]).await?;
 | 
			
		||||
                    bus.write(&buf[..(total_len / 4)]).await?;
 | 
			
		||||
                    Ok(())
 | 
			
		||||
                }
 | 
			
		||||
            })
 | 
			
		||||
 | 
			
		||||
		Loading…
	
	
			
			x
			
			
		
	
		Reference in New Issue
	
	Block a user