From ab7ab19be52f2993b15fcbc9e0aa545c5ce333ec Mon Sep 17 00:00:00 2001
From: geniusgogo <2041245+geniusgogo@users.noreply.github.com>
Date: Mon, 27 Feb 2023 09:59:45 +0800
Subject: [PATCH] fixed ctime timer_delete timerid parameter check. (#6977)

* fixed ctime timer_delete timerid parameter check.
---
 components/libc/compilers/common/ctime.c | 28 +++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/components/libc/compilers/common/ctime.c b/components/libc/compilers/common/ctime.c
index 7e182b5ba9..19cd789bed 100644
--- a/components/libc/compilers/common/ctime.c
+++ b/components/libc/compilers/common/ctime.c
@@ -967,9 +967,15 @@ void timer_id_unlock()
     rt_hw_spin_unlock(&_timer_id_lock);
 }
 
-struct timer_obj *timer_id_get(int timerid)
+struct timer_obj *timer_id_get(rt_ubase_t timerid)
 {
     struct timer_obj *timer;
+
+    if (timerid < 0 || timerid >= TIMER_ID_MAX)
+    {
+        return NULL;
+    }
+
     timer_id_lock();
     if (_g_timerid[timerid] == NULL)
     {
@@ -1071,16 +1077,26 @@ RTM_EXPORT(timer_create);
 int timer_delete(timer_t timerid)
 {
     struct timer_obj *timer;
+    rt_ubase_t ktimerid;
+
+    ktimerid = (rt_ubase_t)timerid;
+
+    if (ktimerid < 0 || ktimerid >= TIMER_ID_MAX)
+    {
+        rt_set_errno(EINVAL);
+        return -1;
+    }
+
     timer_id_lock();
-    if (_g_timerid[(rt_ubase_t)timerid] == NULL)
+    if (_g_timerid[ktimerid] == NULL)
     {
         timer_id_unlock();
         rt_set_errno(EINVAL);
         LOG_E("can not find timer!");
         return -1;
     }
-    timer = _g_timerid[(rt_ubase_t)timerid];
-    timer_id_put((rt_ubase_t)timerid);
+    timer = _g_timerid[ktimerid];
+    timer_id_put(ktimerid);
     timer_id_unlock();
     if (timer == RT_NULL)
     {
@@ -1132,9 +1148,11 @@ int timer_getoverrun(timer_t timerid)
  */
 int timer_gettime(timer_t timerid, struct itimerspec *its)
 {
-    struct timer_obj *timer = timer_id_get((rt_ubase_t)timerid);
+    struct timer_obj *timer;
     rt_uint32_t seconds, nanoseconds;
 
+    timer = timer_id_get((rt_ubase_t)timerid);
+
     if (timer == NULL)
     {
         rt_set_errno(EINVAL);
-- 
GitLab