small fixes

This commit is contained in:
liquidraver
2026-06-11 07:32:50 +02:00
parent a7642cc3e2
commit 0ce847b9bb
3 changed files with 12 additions and 5 deletions
+1
View File
@@ -103,4 +103,5 @@ POWER_AUDIT_HANDOFF.md
POWER_AUDIT_INDEX.md
CRYPTO_AUDIT_HANDOFF.md
CRYPTO_AUDIT_INDEX.md
AUDIT_MASTER_PLAN.md
usb_companion_probe.py
+3 -3
View File
@@ -381,7 +381,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
strcpy(reply, "ERR: bad pubkey");
}
} else if (memcmp(command, "tempradio ", 10) == 0) {
strcpy(tmp, &command[10]);
snprintf(tmp, sizeof(tmp), "%s", &command[10]);
const char* parts[5];
int num = mesh::Utils::parseTextParts(tmp, parts, 5);
float freq = num > 0 ? strtof(parts[0], nullptr) : 0.0f;
@@ -643,7 +643,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
strcpy(reply, "Error: must be on or off");
}
} else if (memcmp(config, "radio ", 6) == 0) {
strcpy(tmp, &config[6]);
snprintf(tmp, sizeof(tmp), "%s", &config[6]);
const char* parts[4];
int num = mesh::Utils::parseTextParts(tmp, parts, 4);
float freq = num > 0 ? strtof(parts[0], nullptr) : 0.0f;
@@ -920,7 +920,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
strcpy(reply, "null");
}
} else if (memcmp(command, "sensor set ", 11) == 0) {
strcpy(tmp, &command[11]);
snprintf(tmp, sizeof(tmp), "%s", &command[11]);
const char* parts[2];
int num = mesh::Utils::parseTextParts(tmp, parts, 2, ' ');
const char* key = (num > 0) ? parts[0] : "";
+8 -2
View File
@@ -186,7 +186,9 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
{
// Handle direct TRACE packets
if (pkt->isRouteDirect() && pkt->getPayloadType() == PAYLOAD_TYPE_TRACE) {
if (pkt->path_len < MAX_PATH_SIZE) {
/* payload_len must hold the 9-byte header (tag+auth+flags) before we
* read it; otherwise `len = payload_len - i` underflows below. */
if (pkt->path_len < MAX_PATH_SIZE && pkt->payload_len >= 9) {
int i = 0;
uint32_t trace_tag;
memcpy(&trace_tag, &pkt->payload[i], 4); i += 4;
@@ -196,7 +198,11 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
uint8_t path_sz = flags & 0x03;
uint8_t len = pkt->payload_len - i;
uint8_t offset = pkt->path_len << path_sz;
/* path_len * (1<<path_sz) can exceed 255 (path_len up to 63,
* entry size up to 8 bytes); a uint8_t offset would wrap and
* steer the isHashMatch() read past the payload buffer. Keep
* this 16-bit — matches upstream Arduino MeshCore. */
uint16_t offset = (uint16_t)pkt->path_len << path_sz;
if (offset >= len) {
onTraceRecv(pkt, trace_tag, auth_code, flags, pkt->path, &pkt->payload[i], len);
} else if (self_id.isHashMatch(&pkt->payload[i + offset], 1 << path_sz) && allowPacketForward(pkt) && !_tables->hasSeen(pkt)) {