Skip to content

Commit c1c5db8

Browse files
authored
[utils] check whether mInfo.mTxInfo.mIeInfo is null before using it (openthread#11238)
The simulation platform radio driver doesn't set the 'mInfo.mTxInfo.mIeInfo' field of the ACK frame. And the function 'otMacFrameUpdateTimeIe()' directly use the 'mInfo.mTxInfo.mIeInfo' field, this may cause the program crash. This commit checks whether 'mInfo.mTxInfo.mIeInfo' is null before using it and sets the 'mInfo.mTxInfo.mIeInfo' field of the ACK frame to null in simulation platform.
1 parent a516a86 commit c1c5db8

File tree

2 files changed

+15
-10
lines changed

2 files changed

+15
-10
lines changed

Diff for: examples/platforms/simulation/radio.c

+1
Original file line numberDiff line numberDiff line change
@@ -420,6 +420,7 @@ void platformRadioInit(void)
420420
#else
421421
sTransmitFrame.mInfo.mTxInfo.mIeInfo = NULL;
422422
#endif
423+
sAckFrame.mInfo.mTxInfo.mIeInfo = NULL;
423424

424425
for (size_t i = 0; i <= kMaxChannel - kMinChannel; i++)
425426
{

Diff for: examples/platforms/utils/mac_frame.cpp

+14-10
Original file line numberDiff line numberDiff line change
@@ -380,20 +380,24 @@ otError otMacFrameProcessTransmitSecurity(otRadioFrame *aFrame, otRadioContext *
380380
#if OPENTHREAD_CONFIG_TIME_SYNC_ENABLE
381381
void otMacFrameUpdateTimeIe(otRadioFrame *aFrame, uint64_t aRadioTime, otRadioContext *aRadioContext)
382382
{
383-
if (aFrame->mInfo.mTxInfo.mIeInfo->mTimeIeOffset != 0)
384-
{
385-
uint8_t *timeIe = aFrame->mPsdu + aFrame->mInfo.mTxInfo.mIeInfo->mTimeIeOffset;
386-
uint64_t time = aRadioTime + aFrame->mInfo.mTxInfo.mIeInfo->mNetworkTimeOffset;
383+
uint8_t *timeIe;
384+
uint64_t time;
385+
386+
VerifyOrExit((aFrame->mInfo.mTxInfo.mIeInfo != nullptr) && (aFrame->mInfo.mTxInfo.mIeInfo->mTimeIeOffset != 0));
387387

388-
*timeIe = aFrame->mInfo.mTxInfo.mIeInfo->mTimeSyncSeq;
388+
timeIe = aFrame->mPsdu + aFrame->mInfo.mTxInfo.mIeInfo->mTimeIeOffset;
389+
time = aRadioTime + aFrame->mInfo.mTxInfo.mIeInfo->mNetworkTimeOffset;
390+
*timeIe = aFrame->mInfo.mTxInfo.mIeInfo->mTimeSyncSeq;
389391

392+
*(++timeIe) = static_cast<uint8_t>(time & 0xff);
393+
for (uint8_t i = 1; i < sizeof(uint64_t); i++)
394+
{
395+
time = time >> 8;
390396
*(++timeIe) = static_cast<uint8_t>(time & 0xff);
391-
for (uint8_t i = 1; i < sizeof(uint64_t); i++)
392-
{
393-
time = time >> 8;
394-
*(++timeIe) = static_cast<uint8_t>(time & 0xff);
395-
}
396397
}
398+
399+
exit:
400+
return;
397401
}
398402
#endif // OPENTHREAD_CONFIG_TIME_SYNC_ENABLE
399403

0 commit comments

Comments
 (0)