fix: 修复28个隐藏Bug(崩溃/越界/内存泄漏/逻辑错误)

涉及9个文件: spiflash.c, DebugCmd.c, LoraTask.c, CatOneTask.c, EthTask.c, update_protocol.c, Public.c, RS485Task.c, main.c

P0致命: 死循环/空指针崩溃/缓冲区溢出/数组越界

P1严重: 数据拷贝错误/通信失败/内存泄漏/状态机错误

P2中等: 竞态条件/时序问题/逻辑隐患

Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c

@@ -41,7 +41,7 @@ void Debug_Printf(char *format, ...)
 {
 	va_list args;
 	va_start(args, format);
-	vsprintf(&tempBuff[0], format, args);
+	vsnprintf(&tempBuff[0], DEBUG_BUFF_MAX, format, args);
 	if(GateWay && GateWay->ConfigPara.Duch == CH_CAT1
 		&& GateWay->ConfigPara.Much != CH_CAT1
 		&& GateWay->ConfigPara.Auch != CH_CAT1
@@ -55,7 +55,7 @@ void Debug_Printf(char *format, ...)
 			line = end ? end + 2 : NULL;
 		}
 	} else {
-		rt_kprintf(tempBuff);
+		rt_kprintf("%s", tempBuff);
 	}
 	va_end(args);
 }
@@ -145,7 +145,7 @@ void DebugAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen)
 		return;
 	//for(argv[argc] = strtok(RxBuff, " "); argv[argc] != NULL; argv[++argc] = strtok(NULL, " "));
 	argp = strtok((char *)rData, " ");
-	for(int i = 0; i < 10; i++) {
+	for(int i = 0; i < 9; i++) {
 		if(argp != NULL) {
 			argv[argc++] = argp;
 			argp = strtok(NULL, " ");
@@ -156,15 +156,18 @@ void DebugAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen)
 		}
 	}
 
-	argp = strtok(argv[argc], "'\r'");
+	argp = strtok(argv[argc], "\r");
 	if(argp != NULL) {
 		argv[argc++] = argp;
 	}
 
+	if(argc == 0)
+		return;
+
 	for(int i = 0; i < DEBUG_CMD_CNT; i++) {
 		if(strcmp(argv[0], DebugFun[i].DBGCmd) == 0) {
 			DebugFun[i].DBGExec(argc, argv);
-			break;  // 未匹配break跳出
+			break;
 		}
 	}
 }
@@ -907,7 +910,7 @@ void DebugCmdReadHisData(int argc, char *argv[])
 		}
 		rt_free(Data);
 		if(Header.LogIdx > StartIdx) {
-			DBG_LOG("His Cmd StartIdx Error, Read First Log, StartIdx = %d!\r\n, Header.LogIdx");
+			DBG_LOG("His Cmd StartIdx Error, Read First Log, StartIdx = %d!\r\n", Header.LogIdx);
 			LogIdx = Header.LogIdx;
 		}
 		else {
@@ -923,8 +926,10 @@ void DebugCmdReadHisData(int argc, char *argv[])
 	}
 	while(ReadNum > 0) {
 		ret = ReadLog(&Header, &Data, LogIdx);
-		if(ret == 0)
+		if(ret == 0) {
+			rt_free(Data);
 			return;
+		}
 		
 		LogIdx++;
 		ReadNum--;
@@ -1208,7 +1213,7 @@ void DebugCmdTimeSync(int argc, char *argv[])
 		return;
 	}
 
-	ret = sscanf(argv[1], "%d-%d-%d,%d:%d:%d\r\n", &year, &month, &day, &hour, &min, &sec);
+	ret = sscanf(argv[1], "%d-%d-%d,%d:%d:%d", &year, &month, &day, &hour, &min, &sec);
 	if(ret != 6 || year < 2022 || year > 2099 || month > 12 || day > 31 || hour > 60 || min > 60 || sec > 60) {
 		DBG_LOG("Parameter error.\r\n");
 		return;
@@ -1619,11 +1624,11 @@ static void DebugCmdCali(int argc, char *argv[])
 	}
 	else if(mac[2] == 0x02) { //RS485ͨѶ
 		if(GateWay->ConfigPara.Rs485Ch1.Enable == true && !GateWay->ConfigPara.Rs485Ch1.CommUnitEnable) {
-			GateWay->ConfigPara.Rs485Ch1.RS485Send(Rs485Cmd, sizeof(CommUnitFrameHeader_t) + 2);
+			GateWay->ConfigPara.Rs485Ch1.RS485Send(CommUnitCmd, sizeof(CommUnitFrameHeader_t) + 2);
 			DBG_LOG("Calibrate CommUnit: %s!\r\n", argv[1]);
 		}
 		else if(GateWay->ConfigPara.Rs485Ch2.Enable == true && !GateWay->ConfigPara.Rs485Ch2.CommUnitEnable) {
-			GateWay->ConfigPara.Rs485Ch2.RS485Send(Rs485Cmd, sizeof(CommUnitFrameHeader_t) + 2);
+			GateWay->ConfigPara.Rs485Ch2.RS485Send(CommUnitCmd, sizeof(CommUnitFrameHeader_t) + 2);
 			DBG_LOG("Calibrate CommUnit: %s!\r\n", argv[1]);
 		}
 		else {
@@ -1701,7 +1706,7 @@ static void DebugLaserConfig(int argc, char *argv[])
 		ret = CheckCommUnitReg(GateWay, mac);
 		if(ret < 0) {
 			DBG_LOG("The CommUnit was not found!\r\n");
-			
+			return;
 		}
 	}
 	else

Project/GateWay/source/User/Src/CatOneTask.c

@@ -43,7 +43,7 @@ void Cat1DuchSend(const char *text, uint16_t len)
 
 #define	CATONE_RESET_DELAY_TIME_MAX				(5 * 60 * 1000)
 
-const char *CatOneATCmdStr[16] = {
+const char *CatOneATCmdStr[18] = {
 	"NULL",
 	"AT\r\n",						//开机检测
 	"ATE0\r\n",					//关回显
@@ -182,6 +182,7 @@ void CatOneAtCmdAnalyze(char *RxBuff)
 			p = strstr(RxBuff, "+CGSN");
 		if(p == NULL) {
 			CatOne.ATCmdRet = CAT_ONE_RET_ERR;
+			break;
 		}
 		p = strchr(p, '"');
 			if(p != NULL) {
@@ -206,6 +207,7 @@ void CatOneAtCmdAnalyze(char *RxBuff)
 			p = strstr(RxBuff, "+QCCID");
 		if(p == NULL) {
 			CatOne.ATCmdRet = CAT_ONE_RET_ERR;
+			break;
 		}
 		memset(CatOne.SIM, 0, 32);
 		ret = sscanf(p, "+QCCID: %s\r\n", CatOne.SIM);
@@ -301,7 +303,7 @@ void CatOneAtCmdAnalyze(char *RxBuff)
 
 				ret = sscanf(p, "+LIPURC: 0,1,%d,%119s\r\n", &rLen, rData);
 				if(ret == 2) {
-					if(rLen < 24)
+					if(rLen < 24 || rLen > 120)
 						return;
 					memset(hData, 0x00, 60);
 					hLen = AsciiToHex(rData, hData, rLen);
@@ -639,16 +641,23 @@ void CatOneRev_Thread_Entry(void *parameter)
 	while(1) {
 		result = rt_sem_take(CatOneIRQ_Sem, 500);
 		if(result == RT_EOK) {
+			if(CatOneRxLen > CAT_ONE_REV_LEN_MAX)
+				CatOneRxLen = CAT_ONE_REV_LEN_MAX;
 			memcpy(RxBuffTemp, CatOneRxBuff, CatOneRxLen);
-			RxBuffTemp[CatOneRxLen] = 0;
+			RxBuffTemp[CatOneRxLen < CAT_ONE_REV_LEN_MAX ? CatOneRxLen : CAT_ONE_REV_LEN_MAX - 1] = 0;
 			CatOneRxLen = 0;
 			char *urc = strstr(RxBuffTemp, "+LIPURC: 0,1,");
 			if(urc) {
-				char *data = strchr(strchr(strchr(urc, ',')+1, ',')+1, ',') + 1;
+				char *p1 = strchr(urc, ',');
+				char *p2 = p1 ? strchr(p1 + 1, ',') : NULL;
+				char *p3 = p2 ? strchr(p2 + 1, ',') : NULL;
+				if(p3) {
+					char *data = p3 + 1;
 					char *end = strchr(data, '\r');
 					if(end) *end = 0;
 					DebugAnalyze(GateWay, (uint8_t *)data, strlen(data));
 				}
+			}
 			CatOneAtCmdAnalyze(RxBuffTemp);
 			memset(CatOneRxBuff, 0x00, CAT_ONE_REV_LEN_MAX);
 		}

Project/GateWay/source/User/Src/EthTask.c

@@ -280,8 +280,10 @@ static void EthRev_Thread_Entry(void *parameter)
 		result = rt_sem_take(EthIRQ_Sem, 500);
 		if(result == RT_EOK || EthRxLen > 1) {
 			if(EthRxLen == 0) continue;
+			if(EthRxLen > ETH_RX_LEN_MAX)
+				EthRxLen = ETH_RX_LEN_MAX;
 			memcpy(RxBuffTemp, EthRxBuff, EthRxLen);
-			RxBuffTemp[EthRxLen] = 0;
+			RxBuffTemp[EthRxLen < ETH_RX_LEN_MAX ? EthRxLen : ETH_RX_LEN_MAX - 1] = 0;
 			memset(HexData, 0x00, EthRxLen / 2);
 			uint8_t ret = AsciiToHex(RxBuffTemp, HexData, EthRxLen);
 			if(ret > 0 && HexData[0] == 0x7A) {

Project/GateWay/source/User/Src/LoraTask.c

@@ -22,6 +22,8 @@ int LoraRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen)
 		return -1;
 	
 	sData = rt_malloc(rLen + 5);
+	if(sData == RT_NULL)
+		return -1;
 	sData[0] = rLen;
 	
 //	Debug_Printf("Lora Rev: ");
@@ -31,7 +33,8 @@ int LoraRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen)
 //	Debug_Printf("\r\n");
 	
 	memcpy(&sData[1], rData, rLen);
-	rt_mq_send(GateWay->LoraRev_MQ, sData, rLen + 1);
+	if(rt_mq_send(GateWay->LoraRev_MQ, sData, rLen + 1) != RT_EOK)
+		Debug_Printf("LoraRev MQ Full, Data Lost!\r\n");
 	rt_free(sData);
 	return 0;
 }
@@ -79,7 +82,7 @@ void Lora_Thread_Entry(void *parameter)
 	uint16_t UnitCommReadDelayCnt = 0;
 #endif	
 	uint8_t Payload[256];
-	uint8_t MegData[9];
+	uint8_t MegData[10];
 	
 	GateWay = (GateWayPara)parameter;
 	
@@ -172,6 +175,7 @@ void Lora_Thread_Entry(void *parameter)
 			uint8_t sData[256];
 			if(rt_mq_recv(ChannelMQ(*GateWay, CH_LORA), sData, 256, 0) == RT_EOK) {
 				uint16_t len = (sData[0] | (sData[1] << 8)) + 3;
+				if(len <= 256)
 					Sx1276LoRaSendBuffer(sData, len);
 			}
 		}
@@ -181,12 +185,14 @@ void Lora_Thread_Entry(void *parameter)
 			if(ret == 0xff)	//注册信息
 				continue;
 			
-			if(UnitCommSendFlag && GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].RevNewDataFlag) {
+			if(UnitCommSendFlag && SendUnitCommIdx < COMMUNIT_NUM_MAX && GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].RevNewDataFlag) {
 				UnitCommSendFlag = false;
 				SendUnitCommIdx++;
+				if(SendUnitCommIdx >= COMMUNIT_NUM_MAX)
+					SendUnitCommIdx = 0;
 			}
 		}
-		else if(UnitCommSendFlag) {	//离线判断
+		else if(UnitCommSendFlag && SendUnitCommIdx < COMMUNIT_NUM_MAX) {	//离线判断
 			GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].CommErrCnt++;
 			if(GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].CommErrCnt == 10) {
 				GateWay->ConfigPara.CommUnitArray[SendUnitCommIdx].CommErrCnt = 0;
@@ -202,6 +208,8 @@ void Lora_Thread_Entry(void *parameter)
 			}
 			UnitCommSendFlag = false;
 			SendUnitCommIdx++;
+			if(SendUnitCommIdx >= COMMUNIT_NUM_MAX)
+				SendUnitCommIdx = 0;
 		}
 	}
 #endif

Project/GateWay/source/User/Src/Public.c

@@ -676,6 +676,8 @@ int CommUnitAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, SendData
 					if(GateWay->MuchRegFlag) {	//网关已注册，向服务发送新设备添加指令
 					PayLoadLen = (GateWay->ConfigPara.CommUnitArray[i].SensorN * 6) + 2;
 					MegData = rt_malloc(PayLoadLen + 3);
+					if(MegData == NULL)
+						return 0xff;
 					MegData[0] = PayLoadLen & 0x00ff;;
 					MegData[1] = (PayLoadLen >> 8) & 0x00ff;
 					MegData[2] = NET_COMM_CMD_ADD_UNIT;
@@ -683,7 +685,7 @@ int CommUnitAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, SendData
 					MegData[4] = (GateWay->ConfigPara.CommUnitArray[i].SensorN >> 8) & 0x00ff;
 					for(uint8_t k = 0; k < GateWay->ConfigPara.CommUnitArray[i].SensorN; k++)
 					{
-							memcpy(&MegData[5], GateWay->ConfigPara.CommUnitArray[i].Mac[k], 6);
+						memcpy(&MegData[5 + k * 6], GateWay->ConfigPara.CommUnitArray[i].Mac[k], 6);
 					}
 					UploadSend(MegData, PayLoadLen+5);
 					rt_free(MegData);
@@ -843,6 +845,8 @@ int CommUnitAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, SendData
 				CommUnitCmdSend(GateWay, CUHeader->DevMac, COMM_UNIT_CMD_READ, (uint8_t *)&ctime, 4, Response);	
 #endif
 			MegData = rt_malloc(512);
+			if(MegData == NULL)
+				break;
 			CommUintLen = CommUintOrgData(GateWay, &GateWay->ConfigPara.CommUnitArray[CommUnitIdx], &GateWay->CUDataArray[CommUnitIdx], MegData);
 			//AddLog(&MegData[2], CommUintLen);
 			UploadSend(MegData, CommUintLen);
@@ -1055,7 +1059,9 @@ static int _NetRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, b
 	NetCommFrameHeader NCHeader = (NetCommFrameHeader)rData;
 	
 	uint16_t FrameLen = sizeof(NetCommFrameHeader_t) + NCHeader->PayloadLen;
-	if(FrameLen > CAT_ONE_REV_LEN_MAX)
+	if(FrameLen > CAT_ONE_REV_LEN_MAX - 2)
+		return -1;
+	if(rLen < FrameLen + 2)
 		return -1;
 	if(NCHeader->Header != 0x7A)
 		return -1;
@@ -1273,12 +1279,18 @@ static int _NetRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, b
 			for(int i = *StartIdx; i < *EndIdx; i++) {
 				uint8_t *HisData;
 			int ret = ReadHistoryData(&LogH, &HisData, i);
-				if(HisData != NULL) {
+			if(HisData != NULL && ret > 7) {
 				MegData = rt_malloc(ret + 15);
-					MegData[0] = ret - 1 + 4;
-					MegData[1] = NET_COMM_CMD_HIS_DATA;
-					memcpy(&MegData[2], (uint8_t *)&LogH.LogIdx, 4);
-					sLen = 6;
+				if(MegData == NULL) {
+					rt_free(HisData);
+					continue;
+				}
+				uint16_t PLen = ret - 7 + 4 + 6;
+				MegData[0] = PLen & 0x00ff;
+				MegData[1] = (PLen >> 8) & 0x00ff;
+				MegData[2] = NET_COMM_CMD_HIS_DATA;
+				memcpy(&MegData[3], (uint8_t *)&LogH.LogIdx, 4);
+				sLen = 7;
 				memcpy(&MegData[sLen], HisData, 6);
 				sLen += 6;
 				memcpy(&MegData[sLen], &HisData[7], ret - 7);
@@ -1289,6 +1301,7 @@ static int _NetRevCallBack(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, b
 				rt_thread_delay(10);
 			}
 			else {
+				if(HisData) rt_free(HisData);
 				continue;
 			}
 			}

Project/GateWay/source/User/Src/RS485Task.c

@@ -14,7 +14,7 @@
 SensorCommPara_t SComm1Para;
 SensorCommPara_t SComm2Para;
 
-const uint8_t RS485SensorCmdPayLoadLen[RS485_SENSOR_CMD_END] = {0, 0, 0, 1, 0};
+const uint8_t RS485SensorCmdPayLoadLen[RS485_SENSOR_CMD_END] = {0, 0, 0, 1, 0, 0, 4, 0};
 
 /*****************************************************************************************
 * 函数名称: SavSensorData
@@ -84,7 +84,7 @@ void RS485Analyze(GateWayPara GateWay, SensorCommPara SCPara, CommUnit Para, uin
 				MAIN_DBG_LOG("Sensor%d calibration succeeded!\r\n", Header->SlvAddr);
 			}
 			else {
-				MAIN_DBG_LOG("Sensor%d calibration succeeded!\r\n", Header->SlvAddr);
+				MAIN_DBG_LOG("Sensor%d calibration failed!\r\n", Header->SlvAddr);
 			}
 			break;
 		
@@ -101,6 +101,7 @@ void RS485Analyze(GateWayPara GateWay, SensorCommPara SCPara, CommUnit Para, uin
 			if(SCPara->SendFlag)
 				SCPara->ReadSensorCnt++;
 			DebugDisplaySensorData(Header->SlvAddr, 0, &rData[sizeof(FrameHeader_t)]);
+			break;
 		}
 
 		default:

Project/GateWay/source/User/Src/main.c

@@ -86,13 +86,15 @@ void GateWayInit(void)
   rt_kprintf("AppFlag: 0x%08x\r\n", bootParam.AppFlag);
 	if(bootParam.AppFlag == APP_BOOT_UPGRADE_FLAG) {
 		rt_kprintf("Boot upgrade detected, erasing external Flash...\r\n");
+		FeedDog();
 		SpiFlashEraseChip();
+		FeedDog();
 		bootParam.AppFlag = 0;
 		dev_boot_write_param(bootParam);
 	}
 
 	int ret = ReadPara((uint8_t *)&GateWay.ConfigPara, sizeof(GWConfigPara_t));
-	if(GateWay.ConfigPara.SavFlag != LOG_SAV_FLAG) {
+	if(ret != 0 || GateWay.ConfigPara.SavFlag != LOG_SAV_FLAG) {
 		memset((uint8_t *)&GateWay.ConfigPara, 0x00, sizeof(GWConfigPara_t));
 		GateWay.ConfigPara.SavFlag = LOG_SAV_FLAG;
 		GateWay.ConfigPara.Much = CH_ETH;

Project/GateWay/source/User/Src/spiflash.c

@@ -73,6 +73,26 @@ void SpiFlashWriteData(uint8_t* wData, uint32_t wAddr, uint16_t wLen)
 #ifdef FLASH_TEST
 	memcpy(&flashtestbuff[wAddr], wData, wLen);
 #else
+	uint16_t PageRemain;
+	while(wLen > 0) {
+		PageRemain = SPIFLASH_PAGESIZE - (wAddr % SPIFLASH_PAGESIZE);
+		if(wLen > PageRemain) {
+			SpiFlashWriteEnable();
+			SpiFlashClrNss();
+			SpiFlashSendByte(SPIFLASH_CMD_WRITE);
+			SpiFlashSendByte((wAddr >> 16) & 0x00FF);
+			SpiFlashSendByte((wAddr >> 8) & 0x00FF);
+			SpiFlashSendByte(wAddr & 0x00FF);
+			for(int i = 0; i < PageRemain; i++) {
+				SpiFlashSendByte(wData[i]);
+			}
+			SpiFlashSetNss();
+			SpiFlashWaitForWriteEnd();
+			wData += PageRemain;
+			wAddr += PageRemain;
+			wLen -= PageRemain;
+		}
+		else {
 			SpiFlashWriteEnable();
 			SpiFlashClrNss();
 			SpiFlashSendByte(SPIFLASH_CMD_WRITE);
@@ -84,6 +104,9 @@ void SpiFlashWriteData(uint8_t* wData, uint32_t wAddr, uint16_t wLen)
 			}
 			SpiFlashSetNss();
 			SpiFlashWaitForWriteEnd();
+			wLen = 0;
+		}
+	}
 #endif	
 }
 
@@ -313,7 +336,7 @@ void CheckDelSecter(uint32_t wAddr, uint16_t wLen)
 			return;
 		}
 		DelOffsetAddr = (wAddr / SPIFLASH_SECTORSIZE + 1) * SPIFLASH_SECTORSIZE;
-		DelSectorNum = (wLen - SurplusSpace) / SPIFLASH_SECTORSIZE + 1;
+		DelSectorNum = (wLen - SurplusSpace + SPIFLASH_SECTORSIZE - 1) / SPIFLASH_SECTORSIZE;
 		SetLastLogEndAddr(wAddr + wLen);
 		for(int i = 0; i < DelSectorNum; i++) {
 			SpiFlashEraseSector(DelOffsetAddr);
@@ -338,7 +361,7 @@ void CheckDelSecter(uint32_t wAddr, uint16_t wLen)
 				return;;
 			}
 		}
-		if(i == LOG_SAV_SIZE_MAX) {
+		if(i > LOG_SAV_SIZE_MAX - 4) {
 			ReadAddr += LOG_SAV_SIZE_MAX;
 			if(ReadAddr >= SPIFLASH_SIZE) {		//找不到下一条数据，重置flash
 				Debug_Printf("Add LOG Error, Next Data No Find!\r\n");

Project/GateWay/source/User/Src/update_protocol.c

@@ -54,11 +54,14 @@ int update_unpack(uint8_t* rxData, int rLen,uint8_t *cmd,  uint8_t* dev_addr, vo
     
     uint16_t    check;
 
+    if(rLen < 2 || rxData == NULL || pload == NULL)
+        return -1;
+
     check = CRC_Modbus(CRC16_BASE, rxData, rLen - 2);
     
     crc16 = (rxData[rLen - 1] << 8) | rxData[rLen - 2];
 
-    if (check != crc16 || rxData[0] !=0x7a || pload ==0)
+    if (check != crc16 || rxData[0] !=0x7a)
     {
         return -1;
     }
@@ -71,17 +74,17 @@ int update_unpack(uint8_t* rxData, int rLen,uint8_t *cmd,  uint8_t* dev_addr, vo
     
     if (Frame->Cmd == 0x81){
         
-        //update_protocol_req_t *UpData = (update_protocol_req_t*)&rxData[sizeof(update_protocol_hd_t)];
- 
         pload =  0;
         
         *pLen = 0;
         
-        
     }else if (Frame->Cmd == 0x82){
 
         update_protocol_rsp_t *DownData = (update_protocol_rsp_t *)&rxData[sizeof(update_protocol_hd_t)];
         
+        if(DownData->DataLen > 256 || (int)(sizeof(update_protocol_hd_t) + sizeof(update_protocol_rsp_t) + DownData->DataLen) > rLen)
+            return -1;
+
         memcpy(pload , &rxData[sizeof(update_protocol_hd_t) + sizeof(update_protocol_rsp_t)],DownData->DataLen);
 
         *pLen = DownData->DataLen;