[参考译文] CC2530：ZSTACK3.0.2 -潜在的 NULL 指针解除引用

https://e2e.ti.com/support/wireless-connectivity/zigbee-thread-group/zigbee-and-thread/f/zigbee-thread-forum/1188535/cc2530-zstack3-0-2---potential-null-pointer-dereference

当我在现场系统中遇到问题时、我将使用更新的静态分析工具重新检查代码。

在 Components/stack/zdo/ZDProfile.c 中的以下代码中、dstAddr 可能为空(我对其进行了测试)。

当它为空时 、会调用 fillAndSend、其中空指针通过 ZADDR_TO_AFADDR 宏解引用。

afStatus_t ZDP_MgmtPermitJoinReq( zAddrType_t *dstAddr, byte duration,
                                  byte TcSignificance, byte SecurityEnable )
{
  (void)SecurityEnable;  // Intentionally unreferenced parameter

  // Build buffer
  ZDP_TmpBuf[ZDP_MGMT_PERMIT_JOIN_REQ_DURATION] = duration;
  ZDP_TmpBuf[ZDP_MGMT_PERMIT_JOIN_REQ_TC_SIG]   = TcSignificance;

  // Check of this is a broadcast message
  if ( (dstAddr) && ((dstAddr->addrMode == Addr16Bit) || (dstAddr->addrMode == AddrBroadcast))
      && ((dstAddr->addr.shortAddr == NWK_BROADCAST_SHORTADDR_DEVALL)
          || (dstAddr->addr.shortAddr == NWK_BROADCAST_SHORTADDR_DEVZCZR)
          || (dstAddr->addr.shortAddr == NWK_BROADCAST_SHORTADDR_DEVRXON)) )
  {
    // Send this to our self as well as broadcast to network
    zAddrType_t tmpAddr;

    tmpAddr.addrMode = Addr16Bit;
    tmpAddr.addr.shortAddr = NLME_GetShortAddr();

    fillAndSend( &ZDP_TransID, &tmpAddr, Mgmt_Permit_Join_req,
                      ZDP_MGMT_PERMIT_JOIN_REQ_SIZE );
  }

  // Send the message
  return fillAndSend( &ZDP_TransID, dstAddr, Mgmt_Permit_Join_req,
                      ZDP_MGMT_PERMIT_JOIN_REQ_SIZE );
}

其中的正确实施是什么？