From: Guus Sliepen <guus@meshlink.io>
Date: Wed, 17 Mar 2021 20:19:45 +0000 (+0100)
Subject: Fix potential channel buffer corruption when using an application-provided buffer.
X-Git-Url: https://git.meshlink.io/?a=commitdiff_plain;h=773e88d3742739e1a6375b166967d8595965b0e7;p=meshlink

Fix potential channel buffer corruption when using an application-provided buffer.

If data was still in MeshLink's internal buffer in a wrapped state, and
the application called meshlink_set_channel_*buf_storage(), the wrong
amount of data was copied into the new buffer.
---

diff --git a/src/utcp.c b/src/utcp.c
index 9e2229ad..2fe65050 100644
--- a/src/utcp.c
+++ b/src/utcp.c
@@ -2326,7 +2326,7 @@ static void buffer_transfer(struct buffer *buf, char *newdata, size_t newsize) {
 		// [012345......]
 		uint32_t tailsize = buf->size - buf->offset;
 		memcpy(newdata, buf->data + buf->offset, tailsize);
-		memcpy(newdata + tailsize, buf->data, buf->used - buf->offset);
+		memcpy(newdata + tailsize, buf->data, buf->used - tailsize);
 	} else {
 		// Old situation:
 		// [....012345..]