corrected memory leak issue and added some boundary check

This commit is contained in:
strawmanbobi
2026-01-13 16:31:37 +08:00
parent 2cad5e71a2
commit 225b30018a
4 changed files with 41 additions and 4 deletions

View File

@@ -62,7 +62,7 @@ void noprint(const char *fmt, ...);
#else #else
#define ir_printf noprint #define ir_printf noprint
#endif #endif
#define USER_DATA_SIZE 1636 #define USER_DATA_SIZE 2048
// #define USER_DATA_SIZE 4096 // #define USER_DATA_SIZE 4096
#ifdef __cplusplus #ifdef __cplusplus

View File

@@ -791,6 +791,13 @@ UINT16 ir_decode_combo(const UINT8 category, const UINT8 sub_category,
return IR_DECODE_FAILED; return IR_DECODE_FAILED;
} }
if (sub_category < SUB_CATEGORY_QUATERNARY ||
sub_category >= SUB_CATEGORY_NEXT)
{
ir_printf("wrong remote sub category : %d\n", sub_category);
return IR_DECODE_FAILED;
}
remote_category = (t_remote_category) category; remote_category = (t_remote_category) category;
if (key_code < 0 || key_code >= KEY_CODE_MAX[remote_category]) if (key_code < 0 || key_code >= KEY_CODE_MAX[remote_category])

View File

@@ -69,6 +69,7 @@ static INT8 decode_as_ac(char *file_name)
int first_time = 1; int first_time = 1;
int length = 0; int length = 0;
int index = 0; int index = 0;
INT8 ret_val = IR_DECODE_SUCCEEDED;
// get status // get status
UINT8 supported_mode = 0x00; UINT8 supported_mode = 0x00;
@@ -101,8 +102,8 @@ static INT8 decode_as_ac(char *file_name)
if (IR_DECODE_FAILED == ir_file_open(REMOTE_CATEGORY_AC, 0, file_name)) if (IR_DECODE_FAILED == ir_file_open(REMOTE_CATEGORY_AC, 0, file_name))
{ {
ir_close(); ret_val = IR_DECODE_FAILED;
return IR_DECODE_FAILED; goto _exit;
} }
do do
@@ -246,9 +247,14 @@ static INT8 decode_as_ac(char *file_name)
} }
} while (TRUE); } while (TRUE);
_exit:
ir_close(); ir_close();
return IR_DECODE_SUCCEEDED; if (NULL != ac_status) {
free(ac_status);
}
return ret_val;
} }
static INT8 decode_as_tv(char *file_name, UINT8 ir_hex_encode) static INT8 decode_as_tv(char *file_name, UINT8 ir_hex_encode)

View File

@@ -249,8 +249,16 @@ static void print_ir_time(t_ir_data *data, UINT8 key_index, UINT16 *ir_time)
} }
else if (ir_level == IRDA_LEVEL_LOW) else if (ir_level == IRDA_LEVEL_LOW)
{ {
if (time_index + 1 > USER_DATA_SIZE) {
ir_printf("time index exceeded\n");
return;
}
ir_time[time_index++] = pcycles->mask; ir_time[time_index++] = pcycles->mask;
} }
if (time_index + 1 > USER_DATA_SIZE) {
ir_printf("time index exceeded\n");
return;
}
ir_time[time_index++] = pcycles->space; ir_time[time_index++] = pcycles->space;
ir_level = IRDA_LEVEL_LOW; ir_level = IRDA_LEVEL_LOW;
} }
@@ -263,8 +271,16 @@ static void print_ir_time(t_ir_data *data, UINT8 key_index, UINT16 *ir_time)
} }
else if (ir_level == IRDA_LEVEL_HIGH) else if (ir_level == IRDA_LEVEL_HIGH)
{ {
if (time_index + 1 > USER_DATA_SIZE) {
ir_printf("time index exceeded\n");
return;
}
ir_time[time_index++] = pcycles->space; ir_time[time_index++] = pcycles->space;
} }
if (time_index + 1 > USER_DATA_SIZE) {
ir_printf("time index exceeded\n");
return;
}
ir_time[time_index++] = pcycles->mask; ir_time[time_index++] = pcycles->mask;
ir_level = IRDA_LEVEL_HIGH; ir_level = IRDA_LEVEL_HIGH;
} }
@@ -278,6 +294,10 @@ static void print_ir_time(t_ir_data *data, UINT8 key_index, UINT16 *ir_time)
} }
else if (ir_level == IRDA_LEVEL_HIGH) else if (ir_level == IRDA_LEVEL_HIGH)
{ {
if (time_index + 1 > USER_DATA_SIZE) {
ir_printf("time index exceeded\n");
return;
}
ir_time[time_index++] = pcycles->space; ir_time[time_index++] = pcycles->space;
} }
ir_level = IRDA_LEVEL_LOW; ir_level = IRDA_LEVEL_LOW;
@@ -291,6 +311,10 @@ static void print_ir_time(t_ir_data *data, UINT8 key_index, UINT16 *ir_time)
} }
else if (ir_level == IRDA_LEVEL_LOW) else if (ir_level == IRDA_LEVEL_LOW)
{ {
if (time_index + 1 > USER_DATA_SIZE) {
ir_printf("time index exceeded\n");
return;
}
ir_time[time_index++] = pcycles->mask; ir_time[time_index++] = pcycles->mask;
} }
ir_level = IRDA_LEVEL_HIGH; ir_level = IRDA_LEVEL_HIGH;