CAN: fix length calculation (fixes #12311)

[daniel-starke]

Fix for issue #12311: Potential Buffer Overrun in CANMessage Constructor

The two types of the CANMessage constructor accepting a data buffer have two issues. First, they limit the input buffer size to the 4 least significant bits of the passed length even though a CAN message cannot have more than 8 bytes of payload. Second, the used data length in the following memcpy() uses the initially passed data length which may exceed the internal data buffer size. Both will lead into hard to find bugs if the passed data buffer size is outside the limits according to the CAN standard. This fix intends to solve this by limiting the input data size to 8 bytes.

Impact of changes

There is no known impact.

Migration actions required

None.

Documentation

None. The API did not change from the user's point of view.

---

Pull request type

[x] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[ ] Feature update (New feature / Functionality change / New API)
[ ] Major update (Breaking change E.g. Return code change / API behaviour change)

---

Test results

[x] No Tests required for this change (E.g docs only update)
[ ] Covered by existing mbed-os tests (Greentea or Unittest)
[ ] Tests / results supplied as part of this PR

No test is required but advised to avoid future regressions.

---

Reviewers

@0xc0170 This is my first contribution to this project. Please kindly review this change.

---

[ciarmcom]

@daniel-starke, thank you for your changes.
@ARMmbed/mbed-os-core @ARMmbed/mbed-os-maintainers please review.

[0xc0170]

Can you amend this to the commit message:

The two types of the CANMessage constructor accepting a data buffer have two issues. First, they limit the input buffer size to the 4 least significant bits of the passed length even though a CAN message cannot have more than 8 bytes of payload. Second, the used data length in the following memcpy() uses the initially passed data length which may exceed the internal data buffer size. Both will lead into hard to find bugs if the passed data buffer size is outside the limits according to the CAN standard. This fix intends to solve this by limiting the input data size to 8 bytes.

just add another section there. Plus also add module name if you can to the first line. The proposal:

CAN: fix length calculation in constructionr

The two types of the CANMessage constructor accepting a data buffer have two issues. First, they limit the input buffer size to the 4 least significant bits of the passed length even though a CAN message cannot have more than 8 bytes of payload. Second, the used data length in the following memcpy() uses the initially passed data length which may exceed the internal data buffer size. Both will lead into hard to find bugs if the passed data buffer size is outside the limits according to the CAN standard. This fix intends to solve this by limiting the input data size to 8 bytes.

[mbed-ci]

Test run: SUCCESS

Summary: 11 of 11 test jobs passed
Build number : 1
Build artifacts

Pull request has been modified.

[0xc0170]

CI restarted

[mbed-ci]

Test run: SUCCESS

Summary: 11 of 11 test jobs passed
Build number : 2
Build artifacts