From e061335055e46ff4e545e25c957746034b3948df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20G=C3=B6ttgens?= Date: Tue, 21 Jul 2026 00:31:21 +0200 Subject: [PATCH] Reserve the [Exit] slot when splitting canned messages (#11095) splitConfiguredMessages capped the split loop at CANNED_MESSAGE_MODULE_MESSAGE_MAX_COUNT and then appended [Exit] unconditionally, so messages[] could be written one past its last index and messagesCount could exceed the array size. --- src/modules/CannedMessageModule.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/CannedMessageModule.cpp b/src/modules/CannedMessageModule.cpp index a10add057..dada48193 100644 --- a/src/modules/CannedMessageModule.cpp +++ b/src/modules/CannedMessageModule.cpp @@ -179,7 +179,7 @@ int CannedMessageModule::splitConfiguredMessages() while (i < upTo) { if (this->messageBuffer[i] == '|') { this->messageBuffer[i] = '\0'; // End previous message - if (tempCount >= CANNED_MESSAGE_MODULE_MESSAGE_MAX_COUNT) + if (tempCount >= CANNED_MESSAGE_MODULE_MESSAGE_MAX_COUNT - 1) break; tempMessages[tempCount++] = (this->messageBuffer + i + 1); }