From a9c797b837a943d4b4c3614d5bc63a23dcb9403f Mon Sep 17 00:00:00 2001
From: liquidraver <504870+liquidraver@users.noreply.github.com>
Date: Thu, 11 Jun 2026 13:30:01 +0200
Subject: [PATCH] guard GPS month_days[] index against out-of-range GNSS month
 (gps audit)

---
 .gitignore                                 | 1 +
 zephcore/adapters/gps/ZephyrGPSManager.cpp | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/.gitignore b/.gitignore
index 359f911..a2f8706 100644
--- a/.gitignore
+++ b/.gitignore
@@ -107,3 +107,4 @@ AUDIT_MASTER_PLAN.md
 usb_companion_probe.py
 CORE_MESH_AUDIT_INDEX.md
 UPLINK_AUDIT_INDEX.md
+GPS_AUDIT_INDEX.md
diff --git a/zephcore/adapters/gps/ZephyrGPSManager.cpp b/zephcore/adapters/gps/ZephyrGPSManager.cpp
index 4760c6e..15dda15 100644
--- a/zephcore/adapters/gps/ZephyrGPSManager.cpp
+++ b/zephcore/adapters/gps/ZephyrGPSManager.cpp
@@ -1398,6 +1398,15 @@ int64_t gps_get_utc_time(void)
 	struct gnss_time t = current_utc;
 	k_mutex_unlock(&gps_mutex);
 
+	/* Defensive: the date math below indexes month_days[m] for m < t.month.
+	 * t.month is a uint8_t straight from the GNSS driver — bound it (and the
+	 * day) so a driver that doesn't range-check (the NMEA parser does; binary
+	 * UBX/chip drivers are not all verified) can't drive an OOB read of
+	 * month_days[13] or a garbage RTC set. */
+	if (t.month < 1 || t.month > 12 || t.month_day < 1 || t.month_day > 31) {
+		return 0;
+	}
+
 	int year = 2000 + t.century_year;
 	int days = 0;