From 4e926fcdabd00031473617484e742220d1344c8d Mon Sep 17 00:00:00 2001 From: Risto Date: Mon, 5 Apr 2021 18:43:31 +0200 Subject: [PATCH] Bluetooth.cpp array bounds fix Eliminates accessing array out of it's bounds - below array first element in next line, where buffer[bufferIndex-13] is used. When bufferIndex would be less than 12, out of bounds memory access would occur. --- radio/src/bluetooth.cpp | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/radio/src/bluetooth.cpp b/radio/src/bluetooth.cpp index efb33334e..be35693c7 100644 --- a/radio/src/bluetooth.cpp +++ b/radio/src/bluetooth.cpp @@ -159,11 +159,13 @@ void Bluetooth::appendTrainerByte(uint8_t data) buffer[bufferIndex++] = data; // we check for "DisConnected", but the first byte could be altered (if received in state STATE_DATA_XOR) if (data == '\n') { - if (!strncmp((char *)&buffer[bufferIndex-13], "isConnected", 11)) { - BLUETOOTH_TRACE("BT< DisConnected" CRLF); - state = BLUETOOTH_STATE_DISCONNECTED; - bufferIndex = 0; - wakeupTime += 200; // 1s + if (bufferIndex >= 13) { + if (!strncmp((char *)&buffer[bufferIndex-13], "isConnected", 11)) { + BLUETOOTH_TRACE("BT< DisConnected" CRLF); + state = BLUETOOTH_STATE_DISCONNECTED; + bufferIndex = 0; + wakeupTime += 200; // 1s + } } } }