保存扭矩查抄表写flash检查地址溢出

Signed-off-by: huhui <huhui@sharkgulf.com>

Applications/app/nv_storage.c

@@ -337,7 +337,9 @@ void nv_write_trq_table_begin(int index) {
 
 int nv_write_trq_table_continue(uint8_t *data, int len){
 	int w_pos = decode_u24(data);
-
+	if ((_write_position + len - 3) > one_page_size * trq_Tbl_size) {
+		return -1;
+	}
 	if (w_pos == _write_position && len > 3) {
 		fmc_write_trq_table_continue(data + 3, len - 3);
 		_write_position += len - 3;
@@ -347,8 +349,19 @@ int nv_write_trq_table_continue(uint8_t *data, int len){
 }
 
 static int nv_write_trq_table1(void) {
-	nv_write_trq_table_begin(1);
-	nv_write_trq_table_continue((u8 *)fmc_get_addr(trq_Tbl_idx1), sizeof(trq2dq_table_t));
+	u8 cache[16];
+	int remain = sizeof(trq2dq_table_t);
+	u32 faddr = fmc_get_addr(trq_Tbl_idx0);
+	fmc_write_trq_table_begin(fmc_get_addr(trq_Tbl_idx1));
+
+	while(remain > 0) {
+		int len = min(16, sizeof(trq2dq_table_t));
+		memcpy(cache, (void *)faddr, len);
+		fmc_write_trq_table_continue(cache, len);
+		remain -= len;
+		faddr  += len;
+	}
+	
 	fmc_write_trq_table_end();
 
 	return _trq2dq_table(trq_Tbl_idx1) == NULL ? 1: 0;
@@ -377,7 +390,7 @@ int nv_write_trq_table_check(u8 *data, int len, int index) {
 int nv_write_sn(u8 *data, int len) {
 	mc_sn_t sn;
 	memset(&sn, 0, sizeof(sn));
-	len = min(ARRAY_SIZE(sn.sn), len);
+	len = min(32, len);
 	memcpy(sn.sn, data, len);
 	sn.len = len;
 	sn.crc = crc16_get(data, len);

Applications/foc/commands.c

@@ -466,9 +466,13 @@ static void process_foc_command(foc_cmd_body_t *command) {
 		}
 		case Foc_Write_TRQ_Table:
 		{
-			u32 pos = nv_write_trq_table_continue((u8 *)command->data, command->len);
-			encode_u24(response+3, pos);
-			len += 3;
+			int pos = nv_write_trq_table_continue((u8 *)command->data, command->len);
+			if (pos < 0) {
+				erroCode = FOC_NotAllowed;
+			}else {
+				encode_u24(response+3, pos);
+				len += 3;
+			}
 			break;
 		}
 		case Foc_End_Write_TRQ_Table: