We find there might be issue about ZDP_TmpBuf size in ZDP_ParentAnnce.
1. ZDP_Buf[ ZDP_BUF_SZ ], ZDP_BUF_SZ=80, *ZDP_TmpBuf = ZDP_Buf+1 and this means ZDP_TmpBuf only has 79 in size.
2. If the code goes into the following for-loop, it will copy 80 bytes to *pBuf = ZDP_TmpBuf and that will out of the ZDP_TmpBuf boundary.
for ( i = 0; i < MAX_PARENT_ANNCE_CHILD; i++ )
{
pBuf = osal_cpyExtAddr( pBuf, pChildInfo[childIndex].extAddr );
childIndex++;
len += Z_EXTADDR_LEN;
if ( childIndex == numberOfChildren )
{
pBuf = numOfChild;
*pBuf = i + 1;
// All childs are taken, restart index and go out
childIndex = 0;
return fillAndSend( TransSeq, dstAddr, clusterID, len );
}
}
We think this will cause problem. Ryan Brown1 or Toby, Can you help to verify this issue?