Fix calculation of slice index
total_len is already rounded up, so the `+ 3` is not needed. And even if it was, the calculation should have been `((total_len + 3) / 4)`. `(total_len + 3 / 4)` is equivalent to `total_len` and can overflow the slice, leading to a panic which can easily be triggered by sending large ICMP ECHO packets to the device.
This commit is contained in:
parent
69e92e5639
commit
acaa8b3e8b
@ -762,7 +762,7 @@ where
|
||||
let bus = unsafe { &mut *bus };
|
||||
async {
|
||||
bus.write(&[cmd]).await?;
|
||||
bus.write(&buf[..(total_len + 3 / 4)]).await?;
|
||||
bus.write(&buf[..(total_len / 4)]).await?;
|
||||
Ok(())
|
||||
}
|
||||
})
|
||||
|
Loading…
Reference in New Issue
Block a user