fix: 修复9项致命/严重Bug

C1 protocol.c: frame_len>64校验防溢出 C3 DebugCmd: 5处argc空指针检查 C4 DebugCmd: Rs485Cmd->CommUnitCmd溢出 C5 main: Debug_Thread线程指针检查 C7 Public: 注册循环变量遮蔽修正 C8 spiflash: memcmp越界读修正 H1 RS485Task: 通道号布尔判断修正 H2 DebugCmd: 边界检查&&->||

Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c

@@ -727,7 +727,7 @@ void DebugCmdSetCollTime(int argc, char *argv[])
 	}
 	
 	int time = atoi(argv[1]);
-	if(time < 10 && time > 7200) {
+	if(time < 10 || time > 7200) {
 		DBG_LOG("RS485 Cmd Para Error!\r\n");
 		return;
 	}
@@ -1024,7 +1024,7 @@ void DebugCmdSetCollectTime(int argc, char *argv[])
 	
 	int IntervalTime = atoi(argv[2]);
 	
-	if(IntervalTime < 10 && IntervalTime > 7200) {
+	if(IntervalTime < 10 || IntervalTime > 7200) {
 		DBG_LOG("SCT Cmd Para Error!\r\n");
 		return;
 	}

Project/GateWay/source/User/Src/Public.c

@@ -578,9 +578,9 @@ int CommUnitAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, SendData
 						MegData[2] = NET_COMM_CMD_ADD_UNIT;
             MegData[3] = (GateWay->ConfigPara.CommUnitArray[i].SensorN) & 0x00ff;;
 						MegData[4] = (GateWay->ConfigPara.CommUnitArray[i].SensorN >> 8) & 0x00ff;
-						for(uint8_t i = 0; i < GateWay->ConfigPara.CommUnitArray[i].SensorN; i++)
+						for(uint8_t k = 0; k < GateWay->ConfigPara.CommUnitArray[i].SensorN; k++)
 						{
-							memcpy(&MegData[5], GateWay->ConfigPara.CommUnitArray[i].Mac[i], 6);
+							memcpy(&MegData[5], GateWay->ConfigPara.CommUnitArray[i].Mac[k], 6);
 						}
 						CatOneEthSendQueue(MegData, PayLoadLen+5);
 						rt_free(MegData);

Project/GateWay/source/User/Src/RS485Task.c

@@ -227,7 +227,7 @@ void RS485CmdSend(GateWayPara GateWay, uint8_t CommUintAddr, SensorCommPara Sens
 {
 	SensorCommPara SC;
 	
-	if(CommUintAddr)
+	if(CommUintAddr == 1)
 		SC = &SComm1Para;
 	else
 		SC = &SComm2Para;

Project/GateWay/source/User/Src/main.c

@@ -413,7 +413,7 @@ int main(void)
 		return -1;
 	
 	Debug_Thread = rt_thread_create("DebugUart", Debug_Thread_Entry, &GateWay, 2048, 3, 20);
-	if (RS485Ch2_Thread != RT_NULL)
+	if (Debug_Thread != RT_NULL)
 		rt_thread_startup(Debug_Thread);
 	else
 		return -1;

Project/GateWay/source/User/Src/protocol.c

@@ -60,6 +60,10 @@ int protocol_unpack_frame(
     if (frame == NULL || slave_addr == NULL || command == NULL || payload_len == NULL) {
         return PROTOCOL_ERR_INVALID_PARAM;
     }
+    if (frame_len > 64) {
+        return PROTOCOL_ERR_BUFFER_OVERFLOW;
+    }
+
     if (frame_len < PROTOCOL_FRAME_MIN_SIZE) {
         return PROTOCOL_ERR_INVALID_PARAM;
     }

Project/GateWay/source/User/Src/spiflash.c

@@ -332,7 +332,7 @@ void CheckDelSecter(uint32_t wAddr, uint16_t wLen)
 	while(1) {
 		SpiFlashReadAnyLengthData(LogBuff, ReadAddr, LOG_SAV_SIZE_MAX);
 		int i;
-		for(i = 0; i < LOG_SAV_SIZE_MAX; i++) {
+		for(i = 0; i <= LOG_SAV_SIZE_MAX - 4; i++) {
 			if(memcmp(&LogBuff[i], SavFlag, 4) == 0) {
 				SetFirstLogStartAddr(ReadAddr + i);
 				return;;