From 8fd69e42d22771b78db052fb4888a259267bf075 Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Tue, 7 Jul 2026 09:14:47 +0800 Subject: [PATCH] rt-link: reject frame offset at frame limit The receive sequence filter maps incoming data-frame sequence numbers to zero-based frame offsets. RT_LINK_FRAMES_MAX is the maximum number of split frames, so valid offsets are 0 through RT_LINK_FRAMES_MAX - 1. Reject offset == RT_LINK_FRAMES_MAX before frame handling instead of letting it reach long-frame assembly. Generated-by: OpenAI Codex Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- components/utilities/rt-link/src/rtlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/utilities/rt-link/src/rtlink.c b/components/utilities/rt-link/src/rtlink.c index db691601282..656dae10052 100644 --- a/components/utilities/rt-link/src/rtlink.c +++ b/components/utilities/rt-link/src/rtlink.c @@ -767,7 +767,7 @@ static void rt_link_frame_check(void) { /* Check the receive sequence */ offset = rt_link_check_seq(receive_frame.head.sequence, rt_link_scb->rx_record.rx_seq) - 1; - if (offset > RT_LINK_FRAMES_MAX) + if (offset >= RT_LINK_FRAMES_MAX) { /* exceptional frame, ignore it */ LOG_D("seq (%d) failed, rx_seq (%d) offset=(%d) attr= (%d) status (%d)", receive_frame.head.sequence, rt_link_scb->rx_record.rx_seq, offset, receive_frame.attribute, rt_link_scb->state);