fix: harden ch390 rx protocol handling
This commit is contained in:
+19
-3
@@ -92,6 +92,7 @@ int ch390_peek_packet(uint8_t *rx_status, uint16_t *rx_len)
|
||||
uint32_t ch390_receive_packet(uint8_t *buff, uint8_t *rx_status)
|
||||
{
|
||||
uint8_t nsr;
|
||||
uint8_t ready;
|
||||
uint16_t rx_len = 0;
|
||||
uint8_t ReceiveData[4];
|
||||
|
||||
@@ -107,6 +108,18 @@ uint32_t ch390_receive_packet(uint8_t *buff, uint8_t *rx_status)
|
||||
return 0;
|
||||
}
|
||||
|
||||
(void)ch390_read_mrcmdx();
|
||||
ready = ch390_read_mrcmdx1();
|
||||
if (ready == 0u)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
if (ready != CH390_PKT_RDY)
|
||||
{
|
||||
ch390_rx_reset();
|
||||
return 0;
|
||||
}
|
||||
|
||||
ch390_read_mem(ReceiveData, 4);
|
||||
|
||||
if (rx_status != 0)
|
||||
@@ -115,15 +128,17 @@ uint32_t ch390_receive_packet(uint8_t *buff, uint8_t *rx_status)
|
||||
}
|
||||
rx_len = (uint16_t)ReceiveData[2] | ((uint16_t)ReceiveData[3] << 8);
|
||||
|
||||
if (((ReceiveData[1] & 0x3Fu) != 0u) ||
|
||||
(rx_len < 14u) ||
|
||||
if ((ReceiveData[0] != CH390_PKT_RDY) ||
|
||||
((ReceiveData[1] & 0x3Fu) != 0u) ||
|
||||
(rx_len < (uint16_t)(14u + CH390_PKT_CRC_LEN)) ||
|
||||
(rx_len > CH390_PKT_MAX))
|
||||
{
|
||||
ch390_rx_reset();
|
||||
return 0;
|
||||
}
|
||||
|
||||
ch390_read_mem(buff, rx_len);
|
||||
return rx_len;
|
||||
return (uint32_t)(rx_len - CH390_PKT_CRC_LEN);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -189,6 +204,7 @@ void ch390_rx_reset(void)
|
||||
uint8_t rcr = ch390_read_reg(CH390_RCR);
|
||||
|
||||
ch390_write_reg(CH390_RCR, (uint8_t)(rcr & (uint8_t)(~RCR_RXEN)));
|
||||
ch390_write_reg(CH390_MPTRCR, MPTRCR_RST_RX);
|
||||
ch390_write_reg(CH390_NSR, NSR_RXOV);
|
||||
ch390_write_reg(CH390_ISR, (uint8_t)(ISR_ROS | ISR_ROO | ISR_PR));
|
||||
ch390_write_reg(CH390_RCR, (uint8_t)(rcr | RCR_RXEN));
|
||||
|
||||
Reference in New Issue
Block a user