kevin/meshtastic_firmware
1
0
Fork 0
Code Issues Pull Requests Actions 10 Packages Projects Releases Wiki Activity

Fix bell-append off-by-one write past payload buffer (#11099)

Browse Source 
The send_bell append writes bytes[size] and bytes[size+1] while the guard only checked size < DATA_PAYLOAD_LEN, overrunning the 233-byte payload array by one when size == DATA_PAYLOAD_LEN - 1. Guard on size + 1.
This commit is contained in:
Thomas Göttgens
2026-07-20 18:38:50 -05:00
committed by GitHub
co-authored by GitHub
parent 6f522aad17
commit b8fb42c065
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/graphics/niche/InkHUD/Applets/System/Menu/MenuApplet.cpp
+1 -1
View File
@@ -2624,7 +2624,7 @@ void InkHUD::MenuApplet::sendText(NodeNum dest, ChannelIndex channel, const char
memcpy(p->decoded.payload.bytes, message, p->decoded.payload.size);
// Tack on a bell character if requested
if (moduleConfig.canned_message.send_bell && p->decoded.payload.size < meshtastic_Constants_DATA_PAYLOAD_LEN) {
if (moduleConfig.canned_message.send_bell && p->decoded.payload.size + 1 < meshtastic_Constants_DATA_PAYLOAD_LEN) {
p->decoded.payload.bytes[p->decoded.payload.size] = 7; // Bell character
p->decoded.payload.bytes[p->decoded.payload.size + 1] = '\0'; // Append Null Terminator
p->decoded.payload.size++;