From a6b1a69630f4efff1879e94966287be92c502011 Mon Sep 17 00:00:00 2001 From: nightjoker7 <47129685+nightjoker7@users.noreply.github.com> Date: Wed, 22 Apr 2026 21:04:37 -0500 Subject: [PATCH] StoreForwardModule::historyAdd: memcpy source size, not buffer capacity (#10250) `memcpy(... p.payload.bytes, meshtastic_Constants_DATA_PAYLOAD_LEN)` reads past the actual payload when the incoming packet's payload is shorter than `DATA_PAYLOAD_LEN` (237 bytes). The code just above already records the correct size: this->packetHistory[...].payload_size = p.payload.size; but then the memcpy ignores that and copies the full buffer capacity, pulling uninitialized / adjacent memory bytes into the history entry. Those extra bytes are later rebroadcast whenever the Store & Forward module replays the packet. Fix: memcpy using `p.payload.size` (the actual payload length) instead of the constant buffer capacity. Classification: bounded out-of-bounds READ into the protobuf scratch buffer. Not directly exploitable for RCE (the destination buffer is also DATA_PAYLOAD_LEN), but leaks adjacent memory into replayed packets and is a latent correctness bug. --- src/modules/StoreForwardModule.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/StoreForwardModule.cpp b/src/modules/StoreForwardModule.cpp index 6df0e18f0..6c2efe83f 100644 --- a/src/modules/StoreForwardModule.cpp +++ b/src/modules/StoreForwardModule.cpp @@ -206,7 +206,7 @@ void StoreForwardModule::historyAdd(const meshtastic_MeshPacket &mp) this->packetHistory[this->packetHistoryTotalCount].hop_limit = mp.hop_limit; this->packetHistory[this->packetHistoryTotalCount].via_mqtt = mp.via_mqtt; this->packetHistory[this->packetHistoryTotalCount].transport_mechanism = mp.transport_mechanism; - memcpy(this->packetHistory[this->packetHistoryTotalCount].payload, p.payload.bytes, meshtastic_Constants_DATA_PAYLOAD_LEN); + memcpy(this->packetHistory[this->packetHistoryTotalCount].payload, p.payload.bytes, p.payload.size); this->packetHistoryTotalCount++; }