From fb72c9dd5d2cec0830b76b514b8eea8a972f497a Mon Sep 17 00:00:00 2001 From: YuanHongbin <975559679@qq.com> Date: Thu, 13 Aug 2026 18:20:51 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D28=E4=B8=AA=E9=9A=90?= =?UTF-8?q?=E8=97=8FBug(=E5=B4=A9=E6=BA=83/=E8=B6=8A=E7=95=8C/=E5=86=85?= =?UTF-8?q?=E5=AD=98=E6=B3=84=E6=BC=8F/=E9=80=BB=E8=BE=91=E9=94=99?= =?UTF-8?q?=E8=AF=AF)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 涉及9个文件: spiflash.c, DebugCmd.c, LoraTask.c, CatOneTask.c, EthTask.c, update_protocol.c, Public.c, RS485Task.c, main.c P0致命: 死循环/空指针崩溃/缓冲区溢出/数组越界 P1严重: 数据拷贝错误/通信失败/内存泄漏/状态机错误 P2中等: 竞态条件/时序问题/逻辑隐患 --- .../source/Module/GateWay_Debug/DebugCmd.c | 29 ++++---- Project/GateWay/source/User/Src/CatOneTask.c | 41 ++++++----- Project/GateWay/source/User/Src/EthTask.c | 4 +- Project/GateWay/source/User/Src/LoraTask.c | 18 +++-- Project/GateWay/source/User/Src/Public.c | 71 +++++++++++-------- Project/GateWay/source/User/Src/RS485Task.c | 5 +- Project/GateWay/source/User/Src/main.c | 4 +- Project/GateWay/source/User/Src/spiflash.c | 47 ++++++++---- .../GateWay/source/User/Src/update_protocol.c | 11 +-- 9 files changed, 148 insertions(+), 82 deletions(-) diff --git a/Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c b/Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c index 3fafe02..74221b7 100644 --- a/Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c +++ b/Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c @@ -41,7 +41,7 @@ void Debug_Printf(char *format, ...) { va_list args; va_start(args, format); - vsprintf(&tempBuff[0], format, args); + vsnprintf(&tempBuff[0], DEBUG_BUFF_MAX, format, args); if(GateWay && GateWay->ConfigPara.Duch == CH_CAT1 && GateWay->ConfigPara.Much != CH_CAT1 && GateWay->ConfigPara.Auch != CH_CAT1 @@ -55,7 +55,7 @@ void Debug_Printf(char *format, ...) line = end ? end + 2 : NULL; } } else { - rt_kprintf(tempBuff); + rt_kprintf("%s", tempBuff); } va_end(args); } @@ -145,7 +145,7 @@ void DebugAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen) return; //for(argv[argc] = strtok(RxBuff, " "); argv[argc] != NULL; argv[++argc] = strtok(NULL, " ")); argp = strtok((char *)rData, " "); - for(int i = 0; i < 10; i++) { + for(int i = 0; i < 9; i++) { if(argp != NULL) { argv[argc++] = argp; argp = strtok(NULL, " "); @@ -156,15 +156,18 @@ void DebugAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen) } } - argp = strtok(argv[argc], "'\r'"); + argp = strtok(argv[argc], "\r"); if(argp != NULL) { argv[argc++] = argp; } - + + if(argc == 0) + return; + for(int i = 0; i < DEBUG_CMD_CNT; i++) { if(strcmp(argv[0], DebugFun[i].DBGCmd) == 0) { DebugFun[i].DBGExec(argc, argv); - break; // 未匹配break跳出 + break; } } } @@ -907,7 +910,7 @@ void DebugCmdReadHisData(int argc, char *argv[]) } rt_free(Data); if(Header.LogIdx > StartIdx) { - DBG_LOG("His Cmd StartIdx Error, Read First Log, StartIdx = %d!\r\n, Header.LogIdx"); + DBG_LOG("His Cmd StartIdx Error, Read First Log, StartIdx = %d!\r\n", Header.LogIdx); LogIdx = Header.LogIdx; } else { @@ -923,8 +926,10 @@ void DebugCmdReadHisData(int argc, char *argv[]) } while(ReadNum > 0) { ret = ReadLog(&Header, &Data, LogIdx); - if(ret == 0) + if(ret == 0) { + rt_free(Data); return; + } LogIdx++; ReadNum--; @@ -1208,7 +1213,7 @@ void DebugCmdTimeSync(int argc, char *argv[]) return; } - ret = sscanf(argv[1], "%d-%d-%d,%d:%d:%d\r\n", &year, &month, &day, &hour, &min, &sec); + ret = sscanf(argv[1], "%d-%d-%d,%d:%d:%d", &year, &month, &day, &hour, &min, &sec); if(ret != 6 || year < 2022 || year > 2099 || month > 12 || day > 31 || hour > 60 || min > 60 || sec > 60) { DBG_LOG("Parameter error.\r\n"); return; @@ -1619,11 +1624,11 @@ static void DebugCmdCali(int argc, char *argv[]) } else if(mac[2] == 0x02) { //RS485ͨѶ if(GateWay->ConfigPara.Rs485Ch1.Enable == true && !GateWay->ConfigPara.Rs485Ch1.CommUnitEnable) { - GateWay->ConfigPara.Rs485Ch1.RS485Send(Rs485Cmd, sizeof(CommUnitFrameHeader_t) + 2); + GateWay->ConfigPara.Rs485Ch1.RS485Send(CommUnitCmd, sizeof(CommUnitFrameHeader_t) + 2); DBG_LOG("Calibrate CommUnit: %s!\r\n", argv[1]); } else if(GateWay->ConfigPara.Rs485Ch2.Enable == true && !GateWay->ConfigPara.Rs485Ch2.CommUnitEnable) { - GateWay->ConfigPara.Rs485Ch2.RS485Send(Rs485Cmd, sizeof(CommUnitFrameHeader_t) + 2); + GateWay->ConfigPara.Rs485Ch2.RS485Send(CommUnitCmd, sizeof(CommUnitFrameHeader_t) + 2); DBG_LOG("Calibrate CommUnit: %s!\r\n", argv[1]); } else { @@ -1701,7 +1706,7 @@ static void DebugLaserConfig(int argc, char *argv[]) ret = CheckCommUnitReg(GateWay, mac); if(ret < 0) { DBG_LOG("The CommUnit was not found!\r\n"); - + return; } } else diff --git a/Project/GateWay/source/User/Src/CatOneTask.c b/Project/GateWay/source/User/Src/CatOneTask.c index 4b29acf..3839613 100644 --- a/Project/GateWay/source/User/Src/CatOneTask.c +++ b/Project/GateWay/source/User/Src/CatOneTask.c @@ -43,7 +43,7 @@ void Cat1DuchSend(const char *text, uint16_t len) #define CATONE_RESET_DELAY_TIME_MAX (5 * 60 * 1000) -const char *CatOneATCmdStr[16] = { +const char *CatOneATCmdStr[18] = { "NULL", "AT\r\n", //开机检测 "ATE0\r\n", //关回显 @@ -180,10 +180,11 @@ void CatOneAtCmdAnalyze(char *RxBuff) CatOne.ATCmdRet = CAT_ONE_RET_ERR; } p = strstr(RxBuff, "+CGSN"); - if(p == NULL) { - CatOne.ATCmdRet = CAT_ONE_RET_ERR; - } - p = strchr(p, '"'); + if(p == NULL) { + CatOne.ATCmdRet = CAT_ONE_RET_ERR; + break; + } + p = strchr(p, '"'); if(p != NULL) { memcpy(CatOne.IMEI, p+1, 15); } @@ -204,11 +205,12 @@ void CatOneAtCmdAnalyze(char *RxBuff) CatOne.ATCmdRet = CAT_ONE_RET_ERR; } p = strstr(RxBuff, "+QCCID"); - if(p == NULL) { - CatOne.ATCmdRet = CAT_ONE_RET_ERR; - } - memset(CatOne.SIM, 0, 32); - ret = sscanf(p, "+QCCID: %s\r\n", CatOne.SIM); + if(p == NULL) { + CatOne.ATCmdRet = CAT_ONE_RET_ERR; + break; + } + memset(CatOne.SIM, 0, 32); + ret = sscanf(p, "+QCCID: %s\r\n", CatOne.SIM); if(ret != 1) { memset(CatOne.SIM, 0, 32); } @@ -301,7 +303,7 @@ void CatOneAtCmdAnalyze(char *RxBuff) ret = sscanf(p, "+LIPURC: 0,1,%d,%119s\r\n", &rLen, rData); if(ret == 2) { - if(rLen < 24) + if(rLen < 24 || rLen > 120) return; memset(hData, 0x00, 60); hLen = AsciiToHex(rData, hData, rLen); @@ -639,15 +641,22 @@ void CatOneRev_Thread_Entry(void *parameter) while(1) { result = rt_sem_take(CatOneIRQ_Sem, 500); if(result == RT_EOK) { + if(CatOneRxLen > CAT_ONE_REV_LEN_MAX) + CatOneRxLen = CAT_ONE_REV_LEN_MAX; memcpy(RxBuffTemp, CatOneRxBuff, CatOneRxLen); - RxBuffTemp[CatOneRxLen] = 0; + RxBuffTemp[CatOneRxLen < CAT_ONE_REV_LEN_MAX ? CatOneRxLen : CAT_ONE_REV_LEN_MAX - 1] = 0; CatOneRxLen = 0; char *urc = strstr(RxBuffTemp, "+LIPURC: 0,1,"); if(urc) { - char *data = strchr(strchr(strchr(urc, ',')+1, ',')+1, ',') + 1; - char *end = strchr(data, '\r'); - if(end) *end = 0; - DebugAnalyze(GateWay, (uint8_t *)data, strlen(data)); + char *p1 = strchr(urc, ','); + char *p2 = p1 ? strchr(p1 + 1, ',') : NULL; + char *p3 = p2 ? strchr(p2 + 1, ',') : NULL; + if(p3) { + char *data = p3 + 1; + char *end = strchr(data, '\r'); + if(end) *end = 0; + DebugAnalyze(GateWay, (uint8_t *)data, strlen(data)); + } } CatOneAtCmdAnalyze(RxBuffTemp); memset(CatOneRxBuff, 0x00, CAT_ONE_REV_LEN_MAX); diff --git a/Project/GateWay/source/User/Src/EthTask.c b/Project/GateWay/source/User/Src/EthTask.c index 7ba5821..e065525 100644 --- a/Project/GateWay/source/User/Src/EthTask.c +++ b/Project/GateWay/source/User/Src/EthTask.c @@ -280,8 +280,10 @@ static void EthRev_Thread_Entry(void *parameter) result = rt_sem_take(EthIRQ_Sem, 500); if(result == RT_EOK || EthRxLen > 1) { if(EthRxLen == 0) continue; + if(EthRxLen > ETH_RX_LEN_MAX) + EthRxLen = ETH_RX_LEN_MAX; memcpy(RxBuffTemp, EthRxBuff, EthRxLen); - RxBuffTemp[EthRxLen] = 0; + RxBuffTemp[EthRxLen < ETH_RX_LEN_MAX ? EthRxLen : ETH_RX_LEN_MAX - 1] = 0; memset(HexData, 0x00, EthRxLen / 2); uint8_t ret = AsciiToHex(RxBuffTemp, HexData, EthRxLen); if(ret > 0 && HexData[0] == 0x7A) { diff --git a/Project/GateWay/source/User/Src/LoraTask.c b/Project/GateWay/source/User/Src/LoraTask.c index b21443f..0097e25 100644 --- a/Project/GateWay/source/User/Src/LoraTask.c +++ b/Project/GateWay/source/User/Src/LoraTask.c @@ -22,6 +22,8 @@ int LoraRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen) return -1; sData = rt_malloc(rLen + 5); + if(sData == RT_NULL) + return -1; sData[0] = rLen; // Debug_Printf("Lora Rev: "); @@ -31,7 +33,8 @@ int LoraRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen) // Debug_Printf("\r\n"); memcpy(&sData[1], rData, rLen); - rt_mq_send(GateWay->LoraRev_MQ, sData, rLen + 1); + if(rt_mq_send(GateWay->LoraRev_MQ, sData, rLen + 1) != RT_EOK) + Debug_Printf("LoraRev MQ Full, Data Lost!\r\n"); rt_free(sData); return 0; } @@ -79,7 +82,7 @@ void Lora_Thread_Entry(void *parameter) uint16_t UnitCommReadDelayCnt = 0; #endif uint8_t Payload[256]; - uint8_t MegData[9]; + uint8_t MegData[10]; GateWay = (GateWayPara)parameter; @@ -172,7 +175,8 @@ void Lora_Thread_Entry(void *parameter) uint8_t sData[256]; if(rt_mq_recv(ChannelMQ(*GateWay, CH_LORA), sData, 256, 0) == RT_EOK) { uint16_t len = (sData[0] | (sData[1] << 8)) + 3; - Sx1276LoRaSendBuffer(sData, len); + if(len <= 256) + Sx1276LoRaSendBuffer(sData, len); } } result = rt_mq_recv(GateWay->LoraRev_MQ, Payload, 256, 1000); @@ -181,12 +185,14 @@ void Lora_Thread_Entry(void *parameter) if(ret == 0xff) //注册信息 continue; - if(UnitCommSendFlag && GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].RevNewDataFlag) { + if(UnitCommSendFlag && SendUnitCommIdx < COMMUNIT_NUM_MAX && GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].RevNewDataFlag) { UnitCommSendFlag = false; SendUnitCommIdx++; + if(SendUnitCommIdx >= COMMUNIT_NUM_MAX) + SendUnitCommIdx = 0; } } - else if(UnitCommSendFlag) { //离线判断 + else if(UnitCommSendFlag && SendUnitCommIdx < COMMUNIT_NUM_MAX) { //离线判断 GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].CommErrCnt++; if(GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].CommErrCnt == 10) { GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].CommErrCnt = 0; @@ -202,6 +208,8 @@ void Lora_Thread_Entry(void *parameter) } UnitCommSendFlag = false; SendUnitCommIdx++; + if(SendUnitCommIdx >= COMMUNIT_NUM_MAX) + SendUnitCommIdx = 0; } } #endif diff --git a/Project/GateWay/source/User/Src/Public.c b/Project/GateWay/source/User/Src/Public.c index 8594f70..0bbed2b 100644 --- a/Project/GateWay/source/User/Src/Public.c +++ b/Project/GateWay/source/User/Src/Public.c @@ -674,20 +674,22 @@ int CommUnitAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, SendData CommUnitCmdSend(GateWay, CUHeader->DevMac, COMM_UNIT_CMD_REG, &ret, 1, Response); if(GateWay->MuchRegFlag) { //网关已注册，向服务发送新设备添加指令 - PayLoadLen = (GateWay->ConfigPara.CommUnitArray[i].SensorN * 6) + 2; - MegData = rt_malloc(PayLoadLen + 3); - MegData[0] = PayLoadLen & 0x00ff;; - MegData[1] = (PayLoadLen >> 8) & 0x00ff; - MegData[2] = NET_COMM_CMD_ADD_UNIT; + PayLoadLen = (GateWay->ConfigPara.CommUnitArray[i].SensorN * 6) + 2; + MegData = rt_malloc(PayLoadLen + 3); + if(MegData == NULL) + return 0xff; + MegData[0] = PayLoadLen & 0x00ff;; + MegData[1] = (PayLoadLen >> 8) & 0x00ff; + MegData[2] = NET_COMM_CMD_ADD_UNIT; MegData[3] = (GateWay->ConfigPara.CommUnitArray[i].SensorN) & 0x00ff;; - MegData[4] = (GateWay->ConfigPara.CommUnitArray[i].SensorN >> 8) & 0x00ff; - for(uint8_t k = 0; k < GateWay->ConfigPara.CommUnitArray[i].SensorN; k++) - { - memcpy(&MegData[5], GateWay->ConfigPara.CommUnitArray[i].Mac[k], 6); - } - UploadSend(MegData, PayLoadLen+5); - rt_free(MegData); + MegData[4] = (GateWay->ConfigPara.CommUnitArray[i].SensorN >> 8) & 0x00ff; + for(uint8_t k = 0; k < GateWay->ConfigPara.CommUnitArray[i].SensorN; k++) + { + memcpy(&MegData[5 + k * 6], GateWay->ConfigPara.CommUnitArray[i].Mac[k], 6); } + UploadSend(MegData, PayLoadLen+5); + rt_free(MegData); + } return 0xff; } } @@ -843,6 +845,8 @@ int CommUnitAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, SendData CommUnitCmdSend(GateWay, CUHeader->DevMac, COMM_UNIT_CMD_READ, (uint8_t *)&ctime, 4, Response); #endif MegData = rt_malloc(512); + if(MegData == NULL) + break; CommUintLen = CommUintOrgData(GateWay, &GateWay->ConfigPara.CommUnitArray[CommUnitIdx], &GateWay->CUDataArray[CommUnitIdx], MegData); //AddLog(&MegData[2], CommUintLen); UploadSend(MegData, CommUintLen); @@ -1055,7 +1059,9 @@ static int _NetRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, b NetCommFrameHeader NCHeader = (NetCommFrameHeader)rData; uint16_t FrameLen = sizeof(NetCommFrameHeader_t) + NCHeader->PayloadLen; - if(FrameLen > CAT_ONE_REV_LEN_MAX) + if(FrameLen > CAT_ONE_REV_LEN_MAX - 2) + return -1; + if(rLen < FrameLen + 2) return -1; if(NCHeader->Header != 0x7A) return -1; @@ -1272,25 +1278,32 @@ static int _NetRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, b LogH.LogEndAddr = 0; for(int i = *StartIdx; i < *EndIdx; i++) { uint8_t *HisData; - int ret = ReadHistoryData(&LogH, &HisData, i); - if(HisData != NULL) { - MegData = rt_malloc(ret + 15); - MegData[0] = ret - 1 + 4; - MegData[1] = NET_COMM_CMD_HIS_DATA; - memcpy(&MegData[2], (uint8_t *)&LogH.LogIdx, 4); - sLen = 6; - memcpy(&MegData[sLen], HisData, 6); - sLen += 6; - memcpy(&MegData[sLen], &HisData[7], ret - 7); - sLen += ret - 7; - UploadSend(MegData, sLen); - rt_free(MegData); + int ret = ReadHistoryData(&LogH, &HisData, i); + if(HisData != NULL && ret > 7) { + MegData = rt_malloc(ret + 15); + if(MegData == NULL) { rt_free(HisData); - rt_thread_delay(10); - } - else { continue; } + uint16_t PLen = ret - 7 + 4 + 6; + MegData[0] = PLen & 0x00ff; + MegData[1] = (PLen >> 8) & 0x00ff; + MegData[2] = NET_COMM_CMD_HIS_DATA; + memcpy(&MegData[3], (uint8_t *)&LogH.LogIdx, 4); + sLen = 7; + memcpy(&MegData[sLen], HisData, 6); + sLen += 6; + memcpy(&MegData[sLen], &HisData[7], ret - 7); + sLen += ret - 7; + UploadSend(MegData, sLen); + rt_free(MegData); + rt_free(HisData); + rt_thread_delay(10); + } + else { + if(HisData) rt_free(HisData); + continue; + } } break;} diff --git a/Project/GateWay/source/User/Src/RS485Task.c b/Project/GateWay/source/User/Src/RS485Task.c index c51c35e..a6458e2 100644 --- a/Project/GateWay/source/User/Src/RS485Task.c +++ b/Project/GateWay/source/User/Src/RS485Task.c @@ -14,7 +14,7 @@ SensorCommPara_t SComm1Para; SensorCommPara_t SComm2Para; -const uint8_t RS485SensorCmdPayLoadLen[RS485_SENSOR_CMD_END] = {0, 0, 0, 1, 0}; +const uint8_t RS485SensorCmdPayLoadLen[RS485_SENSOR_CMD_END] = {0, 0, 0, 1, 0, 0, 4, 0}; /***************************************************************************************** * 函数名称: SavSensorData @@ -84,7 +84,7 @@ void RS485Analyze(GateWayPara GateWay, SensorCommPara SCPara, CommUnit Para, uin MAIN_DBG_LOG("Sensor%d calibration succeeded!\r\n", Header->SlvAddr); } else { - MAIN_DBG_LOG("Sensor%d calibration succeeded!\r\n", Header->SlvAddr); + MAIN_DBG_LOG("Sensor%d calibration failed!\r\n", Header->SlvAddr); } break; @@ -101,6 +101,7 @@ void RS485Analyze(GateWayPara GateWay, SensorCommPara SCPara, CommUnit Para, uin if(SCPara->SendFlag) SCPara->ReadSensorCnt++; DebugDisplaySensorData(Header->SlvAddr, 0, &rData[sizeof(FrameHeader_t)]); + break; } default: diff --git a/Project/GateWay/source/User/Src/main.c b/Project/GateWay/source/User/Src/main.c index 136d260..90a56e8 100644 --- a/Project/GateWay/source/User/Src/main.c +++ b/Project/GateWay/source/User/Src/main.c @@ -86,13 +86,15 @@ void GateWayInit(void) rt_kprintf("AppFlag: 0x%08x\r\n", bootParam.AppFlag); if(bootParam.AppFlag == APP_BOOT_UPGRADE_FLAG) { rt_kprintf("Boot upgrade detected, erasing external Flash...\r\n"); + FeedDog(); SpiFlashEraseChip(); + FeedDog(); bootParam.AppFlag = 0; dev_boot_write_param(bootParam); } int ret = ReadPara((uint8_t *)&GateWay.ConfigPara, sizeof(GWConfigPara_t)); - if(GateWay.ConfigPara.SavFlag != LOG_SAV_FLAG) { + if(ret != 0 || GateWay.ConfigPara.SavFlag != LOG_SAV_FLAG) { memset((uint8_t *)&GateWay.ConfigPara, 0x00, sizeof(GWConfigPara_t)); GateWay.ConfigPara.SavFlag = LOG_SAV_FLAG; GateWay.ConfigPara.Much = CH_ETH; diff --git a/Project/GateWay/source/User/Src/spiflash.c b/Project/GateWay/source/User/Src/spiflash.c index 9ea928f..fff2bb6 100644 --- a/Project/GateWay/source/User/Src/spiflash.c +++ b/Project/GateWay/source/User/Src/spiflash.c @@ -73,17 +73,40 @@ void SpiFlashWriteData(uint8_t* wData, uint32_t wAddr, uint16_t wLen) #ifdef FLASH_TEST memcpy(&flashtestbuff[wAddr], wData, wLen); #else - SpiFlashWriteEnable(); - SpiFlashClrNss(); - SpiFlashSendByte(SPIFLASH_CMD_WRITE); - SpiFlashSendByte((wAddr >> 16) & 0x00FF); - SpiFlashSendByte((wAddr >> 8) & 0x00FF); - SpiFlashSendByte(wAddr & 0x00FF); - for(int i = 0; i < wLen; i++) { - SpiFlashSendByte(wData[i]); + uint16_t PageRemain; + while(wLen > 0) { + PageRemain = SPIFLASH_PAGESIZE - (wAddr % SPIFLASH_PAGESIZE); + if(wLen > PageRemain) { + SpiFlashWriteEnable(); + SpiFlashClrNss(); + SpiFlashSendByte(SPIFLASH_CMD_WRITE); + SpiFlashSendByte((wAddr >> 16) & 0x00FF); + SpiFlashSendByte((wAddr >> 8) & 0x00FF); + SpiFlashSendByte(wAddr & 0x00FF); + for(int i = 0; i < PageRemain; i++) { + SpiFlashSendByte(wData[i]); + } + SpiFlashSetNss(); + SpiFlashWaitForWriteEnd(); + wData += PageRemain; + wAddr += PageRemain; + wLen -= PageRemain; + } + else { + SpiFlashWriteEnable(); + SpiFlashClrNss(); + SpiFlashSendByte(SPIFLASH_CMD_WRITE); + SpiFlashSendByte((wAddr >> 16) & 0x00FF); + SpiFlashSendByte((wAddr >> 8) & 0x00FF); + SpiFlashSendByte(wAddr & 0x00FF); + for(int i = 0; i < wLen; i++) { + SpiFlashSendByte(wData[i]); + } + SpiFlashSetNss(); + SpiFlashWaitForWriteEnd(); + wLen = 0; + } } - SpiFlashSetNss(); - SpiFlashWaitForWriteEnd(); #endif } @@ -313,7 +336,7 @@ void CheckDelSecter(uint32_t wAddr, uint16_t wLen) return; } DelOffsetAddr = (wAddr / SPIFLASH_SECTORSIZE + 1) * SPIFLASH_SECTORSIZE; - DelSectorNum = (wLen - SurplusSpace) / SPIFLASH_SECTORSIZE + 1; + DelSectorNum = (wLen - SurplusSpace + SPIFLASH_SECTORSIZE - 1) / SPIFLASH_SECTORSIZE; SetLastLogEndAddr(wAddr + wLen); for(int i = 0; i < DelSectorNum; i++) { SpiFlashEraseSector(DelOffsetAddr); @@ -338,7 +361,7 @@ void CheckDelSecter(uint32_t wAddr, uint16_t wLen) return;; } } - if(i == LOG_SAV_SIZE_MAX) { + if(i > LOG_SAV_SIZE_MAX - 4) { ReadAddr += LOG_SAV_SIZE_MAX; if(ReadAddr >= SPIFLASH_SIZE) { //找不到下一条数据，重置flash Debug_Printf("Add LOG Error, Next Data No Find!\r\n"); diff --git a/Project/GateWay/source/User/Src/update_protocol.c b/Project/GateWay/source/User/Src/update_protocol.c index 3bff818..d1661f0 100644 --- a/Project/GateWay/source/User/Src/update_protocol.c +++ b/Project/GateWay/source/User/Src/update_protocol.c @@ -54,11 +54,14 @@ int update_unpack(uint8_t* rxData, int rLen,uint8_t *cmd, uint8_t* dev_addr, vo uint16_t check; + if(rLen < 2 || rxData == NULL || pload == NULL) + return -1; + check = CRC_Modbus(CRC16_BASE, rxData, rLen - 2); crc16 = (rxData[rLen - 1] << 8) | rxData[rLen - 2]; - if (check != crc16 || rxData[0] !=0x7a || pload ==0) + if (check != crc16 || rxData[0] !=0x7a) { return -1; } @@ -71,17 +74,17 @@ int update_unpack(uint8_t* rxData, int rLen,uint8_t *cmd, uint8_t* dev_addr, vo if (Frame->Cmd == 0x81){ - //update_protocol_req_t *UpData = (update_protocol_req_t*)&rxData[sizeof(update_protocol_hd_t)]; - pload = 0; *pLen = 0; - }else if (Frame->Cmd == 0x82){ update_protocol_rsp_t *DownData = (update_protocol_rsp_t *)&rxData[sizeof(update_protocol_hd_t)]; + if(DownData->DataLen > 256 || (int)(sizeof(update_protocol_hd_t) + sizeof(update_protocol_rsp_t) + DownData->DataLen) > rLen) + return -1; + memcpy(pload , &rxData[sizeof(update_protocol_hd_t) + sizeof(update_protocol_rsp_t)],DownData->DataLen); *pLen = DownData->DataLen;