[X9D] Buffer overflow in BMP code

[X9D] External clock for RTC

src/bmp.cpp

@@ -116,7 +116,7 @@ const pm_char * bmpLoad(uint8_t *dest, const char *filename)
     return STR_INCOMPATIBLE;
   }
 
-  if (width > 64 || height > 32) {
+  if (width > MODEL_BITMAP_WIDTH  || height > MODEL_BITMAP_HEIGHT) {
     f_close(&bmpFile);
     return STR_INCOMPATIBLE;
   }

src/open9x.cpp

@@ -94,7 +94,7 @@ EEGeneral  g_eeGeneral;
 ModelData  g_model;
 
 #if defined(PCBX9D) && defined(SDCARD)
-uint8_t modelBitmap[64*32/8];
+uint8_t modelBitmap[MODEL_BITMAP_SIZE];
 void loadModelBitmap()
 {
   char lfn[] = BITMAPS_PATH "/xxxxxxxxxx.bmp";

src/open9x.h

@@ -229,7 +229,10 @@ extern char modelNames[MAX_MODELS][sizeof(g_model.name)];
 #endif
 
 #if defined(PCBX9D)
-extern uint8_t modelBitmap[64*32/8];
+#define MODEL_BITMAP_WIDTH  64
+#define MODEL_BITMAP_HEIGHT 32
+#define MODEL_BITMAP_SIZE   (2+MODEL_BITMAP_WIDTH*MODEL_BITMAP_HEIGHT/8)
+extern uint8_t modelBitmap[MODEL_BITMAP_SIZE];
 void loadModelBitmap();
 #define LOAD_MODEL_BITMAP() loadModelBitmap()
 #else

src/x9d/rtc_driver.cpp

@@ -72,7 +72,7 @@ void rtc_init()
 	RCC_APB1PeriphClockCmd(RCC_APB1Periph_PWR, ENABLE);
 	PWR_BackupAccessCmd(ENABLE);
 	
-	RCC_RTCCLKConfig(RCC_RTCCLKSource_LSI);
+	RCC_RTCCLKConfig(RCC_RTCCLKSource_LSE);
 	RCC_RTCCLKCmd(ENABLE);
 	
 	RTC_InitStruct.RTC_HourFormat = RTC_HourFormat_24;