fix: FoE request length check

soes/esc.c

@@ -8,6 +8,8 @@
 #include "esc_coe.h"
 #include "esc_foe.h"
 
+CC_STATIC_ASSERT((MBXSIZE > ESC_MBXHSIZE) && (MBXSIZEBOOT > ESC_MBXHSIZE), "Mailbox size too small.");
+
 /** \file
  * \brief
  * Base EtherCAT functions for handling the Data Link Layer and Malilboxes
@@ -16,6 +18,20 @@
  * State machine and mailbox support.
  */
 
+/** Update and set cnt value for a desired mailbox out buffer.
+ *
+ * @param[in] n   = Index of mailbox buffer.
+ */
+static void setmbxoutcnt (uint8_t const n)
+{
+   ESCvar.mbxcnt = (ESCvar.mbxcnt + 1U) & 0x07U;
+   if (ESCvar.mbxcnt == 0U)
+   {
+      ESCvar.mbxcnt = 1U;
+   }
+   ((_MBXh*)&MBX[n * ESC_MBXSIZE])->mbxcnt = ESCvar.mbxcnt;
+}
+
 /** Write AL Status Code to the ESC.
  *
  * @param[in] errornumber   = Write an by EtherCAT specified Error number register 0x134 AL Status Code
@@ -414,8 +430,10 @@ void ESC_stopmbx (void)
    ESCvar.xoe = 0;
    ESCvar.mbxfree = 1;
    ESCvar.toggle = 0;
+   ESCvar.mbxcnt = 0;
    ESCvar.mbxincnt = 0;
    ESCvar.segmented = 0;
+   ESCvar.segmentedToggle = 0;
    ESCvar.frags = 0;
    ESCvar.fragsleft = 0;
    ESCvar.txcue = 0;
@@ -486,7 +504,7 @@ void ESC_ackmbxread (void)
 
 /** Allocate and prepare a mailbox buffer. Take the first Idle buffer from the End.
  * Set Mailbox control state to be used for outbox and fill the mailbox buffer with
- * address master and mailbox next CNT value between 1-7.
+ * address master.
  *
  * @return The index of Mailbox buffer prepared for outbox. IF no buffer is available return 0.
  */
@@ -502,16 +520,10 @@ uint8_t ESC_claimbuffer (void)
    {
       MBXcontrol[n].state = MBXstate_outclaim;
       MBh = (_MBXh *)&MBX[n * ESC_MBXSIZE];
-      ESCvar.mbxcnt++;
-      ESCvar.mbxcnt = (ESCvar.mbxcnt & 0x07);
-      if (ESCvar.mbxcnt == 0)
-      {
-         ESCvar.mbxcnt = 1;
-      }
       MBh->address = htoes (0x0000);      // destination is master
       MBh->channel = 0;
       MBh->priority = 0;
-      MBh->mbxcnt = ESCvar.mbxcnt & 0xFU;
+      MBh->reserved = 0;
       ESCvar.txcue++;
    }
    return n;
@@ -530,6 +542,7 @@ uint8_t ESC_outreqbuffer (void)
    }
    return n;
 }
+
 /** Allocate and prepare a mailbox buffer for sending an error message. Take the first Idle
  * buffer from the end. Set Mailbox control state to be used for outbox and fill the mailbox
  * buffer with error information.
@@ -639,6 +652,7 @@ uint8_t ESC_mbxprocess (void)
       /* outmbx empty and outreq mbx available */
       if (mbxhandle)
       {
+         setmbxoutcnt (mbxhandle);
          ESC_writembx (mbxhandle);
          /* Refresh SM status */
          ESC_SMstatus (1);
@@ -658,7 +672,7 @@ uint8_t ESC_mbxprocess (void)
    {
       ESC_readmbx ();
       ESCvar.SM[0].MBXstat = 0;
-      if (etohs (MBh->length) == 0)
+      if ((etohs (MBh->length) == 0) || (etohs (MBh->length) > (ESC_MBX0_sml - ESC_MBXHSIZE)))
       {
          MBX_error (MBXERR_INVALIDHEADER);
          /* drop mailbox */
@@ -712,7 +726,7 @@ uint8_t ESC_checkSM23 (uint8_t state)
    _ESCsm2 *SM;
    ESC_read (ESCREG_SM2, (void *) &ESCvar.SM[2], sizeof (ESCvar.SM[2]));
    SM = (_ESCsm2 *) & ESCvar.SM[2];
-   
+
    /* Check SM settings */
    if ((etohs (SM->PSA) != ESC_SM2_sma) ||
        (SM->Command != ESC_SM2_smc))
@@ -904,7 +918,7 @@ void ESC_stopinput (void)
  */
 uint8_t ESC_startoutput (uint8_t state)
 {
-	
+
    /* If outputs > 0 , enable SM2 */
    if (ESCvar.ESC_SM2_sml > 0)
    {

soes/esc.h

@@ -487,6 +487,7 @@ typedef struct
    uint8_t txcue;
    uint8_t mbxfree;
    uint8_t segmented;
+   uint8_t segmentedToggle;
    void *data;
    uint16_t entries;
    uint32_t frags;
@@ -523,14 +524,16 @@ typedef struct CC_PACKED
    uint8_t priority:2;
 
    uint8_t mbxtype:4;
-   uint8_t mbxcnt:4;
+   uint8_t mbxcnt:3;
+   uint8_t reserved:1;
 #endif
 
 #if defined(EC_BIG_ENDIAN)
    uint8_t priority:2;
    uint8_t channel:6;
 
-   uint8_t mbxcnt:4;
+   uint8_t reserved:1;
+   uint8_t mbxcnt:3;
    uint8_t mbxtype:4;
 #endif
 } _MBXh;