From 0ce847b9bbef943b72a27b7a6f3dbfd6c803c2a9 Mon Sep 17 00:00:00 2001
From: liquidraver <504870+liquidraver@users.noreply.github.com>
Date: Thu, 11 Jun 2026 07:32:50 +0200
Subject: [PATCH] small fixes

---
 .gitignore                     |  1 +
 zephcore/helpers/CommonCLI.cpp |  6 +++---
 zephcore/src/Mesh.cpp          | 10 ++++++++--
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9f414fb..9c76f0f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -103,4 +103,5 @@ POWER_AUDIT_HANDOFF.md
 POWER_AUDIT_INDEX.md
 CRYPTO_AUDIT_HANDOFF.md
 CRYPTO_AUDIT_INDEX.md
+AUDIT_MASTER_PLAN.md
 usb_companion_probe.py
diff --git a/zephcore/helpers/CommonCLI.cpp b/zephcore/helpers/CommonCLI.cpp
index 4d1675e..d726cd1 100644
--- a/zephcore/helpers/CommonCLI.cpp
+++ b/zephcore/helpers/CommonCLI.cpp
@@ -381,7 +381,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
             strcpy(reply, "ERR: bad pubkey");
         }
     } else if (memcmp(command, "tempradio ", 10) == 0) {
-        strcpy(tmp, &command[10]);
+        snprintf(tmp, sizeof(tmp), "%s", &command[10]);
         const char* parts[5];
         int num = mesh::Utils::parseTextParts(tmp, parts, 5);
         float freq = num > 0 ? strtof(parts[0], nullptr) : 0.0f;
@@ -643,7 +643,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
                 strcpy(reply, "Error: must be on or off");
             }
         } else if (memcmp(config, "radio ", 6) == 0) {
-            strcpy(tmp, &config[6]);
+            snprintf(tmp, sizeof(tmp), "%s", &config[6]);
             const char* parts[4];
             int num = mesh::Utils::parseTextParts(tmp, parts, 4);
             float freq = num > 0 ? strtof(parts[0], nullptr) : 0.0f;
@@ -920,7 +920,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
             strcpy(reply, "null");
         }
     } else if (memcmp(command, "sensor set ", 11) == 0) {
-        strcpy(tmp, &command[11]);
+        snprintf(tmp, sizeof(tmp), "%s", &command[11]);
         const char* parts[2];
         int num = mesh::Utils::parseTextParts(tmp, parts, 2, ' ');
         const char* key = (num > 0) ? parts[0] : "";
diff --git a/zephcore/src/Mesh.cpp b/zephcore/src/Mesh.cpp
index 712b93d..33e30b0 100644
--- a/zephcore/src/Mesh.cpp
+++ b/zephcore/src/Mesh.cpp
@@ -186,7 +186,9 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
 {
 	// Handle direct TRACE packets
 	if (pkt->isRouteDirect() && pkt->getPayloadType() == PAYLOAD_TYPE_TRACE) {
-		if (pkt->path_len < MAX_PATH_SIZE) {
+		/* payload_len must hold the 9-byte header (tag+auth+flags) before we
+		 * read it; otherwise `len = payload_len - i` underflows below. */
+		if (pkt->path_len < MAX_PATH_SIZE && pkt->payload_len >= 9) {
 			int i = 0;
 			uint32_t trace_tag;
 			memcpy(&trace_tag, &pkt->payload[i], 4); i += 4;
@@ -196,7 +198,11 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
 			uint8_t path_sz = flags & 0x03;
 
 			uint8_t len = pkt->payload_len - i;
-			uint8_t offset = pkt->path_len << path_sz;
+			/* path_len * (1<<path_sz) can exceed 255 (path_len up to 63,
+			 * entry size up to 8 bytes); a uint8_t offset would wrap and
+			 * steer the isHashMatch() read past the payload buffer. Keep
+			 * this 16-bit — matches upstream Arduino MeshCore. */
+			uint16_t offset = (uint16_t)pkt->path_len << path_sz;
 			if (offset >= len) {
 				onTraceRecv(pkt, trace_tag, auth_code, flags, pkt->path, &pkt->payload[i], len);
 			} else if (self_id.isHashMatch(&pkt->payload[i + offset], 1 << path_sz) && allowPacketForward(pkt) && !_tables->hasSeen(pkt)) {