Fix calculation of slice index

total_len is already rounded up, so the `+ 3` is not needed.
And even if it was, the calculation should have been `((total_len + 3) / 4)`.

`(total_len + 3 / 4)` is equivalent to `total_len` and can overflow
the slice, leading to a panic which can easily be triggered by sending
large ICMP ECHO packets to the device.
This commit is contained in:
Jan Niehusmann 2022-08-30 20:36:57 +00:00
parent 69e92e5639
commit acaa8b3e8b

View File

@ -762,7 +762,7 @@ where
let bus = unsafe { &mut *bus };
async {
bus.write(&[cmd]).await?;
bus.write(&buf[..(total_len + 3 / 4)]).await?;
bus.write(&buf[..(total_len / 4)]).await?;
Ok(())
}
})