From a092bfa6365b4bb5b53550774351da1e9b486ab9 Mon Sep 17 00:00:00 2001 From: Ivo Smits Date: Thu, 17 Jun 2021 22:40:22 +0200 Subject: [PATCH] Fix incorrect memory access in Sequans Monarch code The mux value is corrected if it is out of the supported range, but the uncorrected value was used to store the connection object. This caused subsequent dereferences of the corrected mux index to access incorrect data or dereference a null pointer. --- src/TinyGsmClientSequansMonarch.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/TinyGsmClientSequansMonarch.h b/src/TinyGsmClientSequansMonarch.h index ae05bf1..aa77e66 100644 --- a/src/TinyGsmClientSequansMonarch.h +++ b/src/TinyGsmClientSequansMonarch.h @@ -98,7 +98,7 @@ class TinyGsmSequansMonarch } else { this->mux = (mux % TINY_GSM_MUX_COUNT) + 1; } - at->sockets[mux % TINY_GSM_MUX_COUNT] = this; + at->sockets[this->mux % TINY_GSM_MUX_COUNT] = this; return true; }