From 3b424858de9cb8c34bb0a2031cdb2fa90aad0077 Mon Sep 17 00:00:00 2001 From: Hauke Petersen Date: Tue, 22 Sep 2020 11:43:00 +0200 Subject: [PATCH] net/emcute: fix buffer overflow in _willupd_msg() --- sys/net/application_layer/emcute/emcute.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sys/net/application_layer/emcute/emcute.c b/sys/net/application_layer/emcute/emcute.c index 6b9de56220..19631ba1e3 100644 --- a/sys/net/application_layer/emcute/emcute.c +++ b/sys/net/application_layer/emcute/emcute.c @@ -483,11 +483,10 @@ int emcute_willupd_msg(const void *data, size_t len) mutex_lock(&txlock); size_t pos = set_len(tbuf, (len + 1)); - len += (pos + 1); tbuf[pos++] = WILLMSGUPD; memcpy(&tbuf[pos], data, len); - return syncsend(WILLMSGRESP, len, true); + return syncsend(WILLMSGRESP, (pos + len), true); } void emcute_run(uint16_t port, const char *id)