Bluetooth.cpp array bounds fix

Eliminates accessing array out of it's bounds - below array first element in next line, where buffer[bufferIndex-13] is used. When bufferIndex would be less than 12, out of bounds memory access would occur.
This commit is contained in:
Risto
2021-04-05 18:43:31 +02:00
committed by GitHub
parent 60084d2c53
commit 4e926fcdab
+7 -5
View File
@@ -159,11 +159,13 @@ void Bluetooth::appendTrainerByte(uint8_t data)
buffer[bufferIndex++] = data;
// we check for "DisConnected", but the first byte could be altered (if received in state STATE_DATA_XOR)
if (data == '\n') {
if (!strncmp((char *)&buffer[bufferIndex-13], "isConnected", 11)) {
BLUETOOTH_TRACE("BT< DisConnected" CRLF);
state = BLUETOOTH_STATE_DISCONNECTED;
bufferIndex = 0;
wakeupTime += 200; // 1s
if (bufferIndex >= 13) {
if (!strncmp((char *)&buffer[bufferIndex-13], "isConnected", 11)) {
BLUETOOTH_TRACE("BT< DisConnected" CRLF);
state = BLUETOOTH_STATE_DISCONNECTED;
bufferIndex = 0;
wakeupTime += 200; // 1s
}
}
}
}