From bb4f00021fe24f969f601c9be9155ebffa1b5112 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Sat, 18 Jul 2026 16:08:45 +0100 Subject: [PATCH] std: fix Xous UDP recv length over-report and OOB panic recv_inner returned the datagram length instead of the bytes copied into the caller's buffer, and rxlen >= 4075 could index past the receive buffer and panic. Clamp the count to both buffers, mirroring the earlier send_to fix. --- library/std/src/sys/net/connection/xous/udp.rs | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/library/std/src/sys/net/connection/xous/udp.rs b/library/std/src/sys/net/connection/xous/udp.rs index 987b2598d9fb2..281639488a015 100644 --- a/library/std/src/sys/net/connection/xous/udp.rs +++ b/library/std/src/sys/net/connection/xous/udp.rs @@ -179,10 +179,12 @@ impl UdpSocket { } else { return Err(io::const_error!(io::ErrorKind::Other, "library error")); }; - for (&s, d) in rr[22..22 + rxlen as usize].iter().zip(buf.iter_mut()) { - *d = s; - } - Ok((rxlen as usize, addr)) + let max = (rxlen as usize).min(buf.len()).min(rr.len() - 22); + // Both sides must be sliced: `max` is shorter than `buf` whenever + // the datagram doesn't fill it, and `copy_from_slice` panics on a + // length mismatch. + buf[..max].copy_from_slice(&rr[22..][..max]); + Ok((max, addr)) } } else { Err(io::const_error!(io::ErrorKind::InvalidInput, "unable to recv"))