commit f59e2477ba326459b47c6be1adee120c9cdc8e06
author Zheng Wu <ken4647@outlook.com> Wed Oct 30 19:34:45 2024 +0800
committer Dan Kalowsky <dank@deadmime.org> Wed Nov 06 10:06:06 2024 -0800
tree 930b2d68ce6e3299059184f3e7ca4b3131dab7aa
parent de1e76fa4e592bcd8592c64501484b0abf5241dd

drivers: serial: fix potential overflow in fifo_fill and fifo_read

Change the type of num_tx/num_rx to avoid overflow.

Fixes #80599

Signed-off-by: Zheng Wu <ken4647@outlook.com>

drivers/serial/uart_stm32.c

diff --git a/drivers/serial/uart_stm32.c b/drivers/serial/uart_stm32.c
index e0232c5..1f9e7ab 100644
--- a/drivers/serial/uart_stm32.c
+++ b/drivers/serial/uart_stm32.c
@@ -816,15 +816,14 @@
 
 #ifdef CONFIG_UART_INTERRUPT_DRIVEN
 
-typedef void (*fifo_fill_fn)(USART_TypeDef *usart, const void *tx_data,
-			     const uint8_t offset);
+typedef void (*fifo_fill_fn)(USART_TypeDef *usart, const void *tx_data, const int offset);
 
 static int uart_stm32_fifo_fill_visitor(const struct device *dev, const void *tx_data, int size,
 					fifo_fill_fn fill_fn)
 {
 	const struct uart_stm32_config *config = dev->config;
 	USART_TypeDef *usart = config->usart;
-	uint8_t num_tx = 0U;
+	int num_tx = 0U;
 	unsigned int key;
 
 	if (!LL_USART_IsActiveFlag_TXE(usart)) {
@@ -847,8 +846,7 @@
 	return num_tx;
 }
 
-static void fifo_fill_with_u8(USART_TypeDef *usart,
-					 const void *tx_data, const uint8_t offset)
+static void fifo_fill_with_u8(USART_TypeDef *usart, const void *tx_data, const int offset)
 {
 	const uint8_t *data = (const uint8_t *)tx_data;
 	/* Send a character (8bit) */
@@ -865,15 +863,14 @@
 					    fifo_fill_with_u8);
 }
 
-typedef void (*fifo_read_fn)(USART_TypeDef *usart, void *rx_data,
-			     const uint8_t offset);
+typedef void (*fifo_read_fn)(USART_TypeDef *usart, void *rx_data, const int offset);
 
 static int uart_stm32_fifo_read_visitor(const struct device *dev, void *rx_data, const int size,
 					fifo_read_fn read_fn)
 {
 	const struct uart_stm32_config *config = dev->config;
 	USART_TypeDef *usart = config->usart;
-	uint8_t num_rx = 0U;
+	int num_rx = 0U;
 
 	while ((size - num_rx > 0) && LL_USART_IsActiveFlag_RXNE(usart)) {
 		/* RXNE flag will be cleared upon read from DR|RDR register */
@@ -894,8 +891,7 @@
 	return num_rx;
 }
 
-static void fifo_read_with_u8(USART_TypeDef *usart, void *rx_data,
-					 const uint8_t offset)
+static void fifo_read_with_u8(USART_TypeDef *usart, void *rx_data, const int offset)
 {
 	uint8_t *data = (uint8_t *)rx_data;
 
@@ -914,8 +910,7 @@
 
 #ifdef CONFIG_UART_WIDE_DATA
 
-static void fifo_fill_with_u16(USART_TypeDef *usart,
-					  const void *tx_data, const uint8_t offset)
+static void fifo_fill_with_u16(USART_TypeDef *usart, const void *tx_data, const int offset)
 {
 	const uint16_t *data = (const uint16_t *)tx_data;
 
@@ -933,8 +928,7 @@
 					    fifo_fill_with_u16);
 }
 
-static void fifo_read_with_u16(USART_TypeDef *usart, void *rx_data,
-					  const uint8_t offset)
+static void fifo_read_with_u16(USART_TypeDef *usart, void *rx_data, const int offset)
 {
 	uint16_t *data = (uint16_t *)rx_data;