Fix potential channel buffer corruption when using an application-provided buffer.

If data was still in MeshLink's internal buffer in a wrapped state, and
the application called meshlink_set_channel_*buf_storage(), the wrong
amount of data was copied into the new buffer.

diff --git a/src/utcp.c b/src/utcp.c
index 9e2229ad522fb48b2d5431b6658e82671422680e..2fe650508dc90b0c52718a3a71bb16cf6b031262 100644 (file)
--- a/src/utcp.c
+++ b/src/utcp.c
@@ -2326,7 +2326,7 @@ static void buffer_transfer(struct buffer *buf, char *newdata, size_t newsize) {
                // [012345......]
                uint32_t tailsize = buf->size - buf->offset;
                memcpy(newdata, buf->data + buf->offset, tailsize);
-               memcpy(newdata + tailsize, buf->data, buf->used - buf->offset);
+               memcpy(newdata + tailsize, buf->data, buf->used - tailsize);
        } else {
                // Old situation:
                // [....012345..]