From cc8ade829867f2bdd6c748e448540f81df5bdfb6 Mon Sep 17 00:00:00 2001
From: liquidraver <504870+liquidraver@users.noreply.github.com>
Date: Thu, 11 Jun 2026 14:18:15 +0200
Subject: [PATCH] bound AdvertDataParser name copy to _name size (helpers
 audit)

---
 .gitignore                             | 1 +
 zephcore/helpers/AdvertDataHelpers.cpp | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/.gitignore b/.gitignore
index f9a697b..619cc75 100644
--- a/.gitignore
+++ b/.gitignore
@@ -110,3 +110,4 @@ UPLINK_AUDIT_INDEX.md
 GPS_AUDIT_INDEX.md
 UI_AUDIT_INDEX.md
 RADIO2_AUDIT_INDEX.md
+MISC_AUDIT_INDEX.md
diff --git a/zephcore/helpers/AdvertDataHelpers.cpp b/zephcore/helpers/AdvertDataHelpers.cpp
index cf80f3b..8c819f3 100644
--- a/zephcore/helpers/AdvertDataHelpers.cpp
+++ b/zephcore/helpers/AdvertDataHelpers.cpp
@@ -62,6 +62,13 @@ AdvertDataParser::AdvertDataParser(const uint8_t app_data[], uint8_t app_data_le
 
 	if (_flags & ADV_NAME_MASK) {
 		int nlen = app_data_len - i;
+		/* Self-defense: callers clamp app_data_len to MAX_ADVERT_DATA_SIZE
+		 * today, but don't trust that — _name is MAX_ADVERT_DATA_SIZE and the
+		 * NUL goes at _name[nlen], so bound nlen to sizeof(_name)-1 or a
+		 * malformed/oversized advert would overflow this stack object. */
+		if (nlen > (int)sizeof(_name) - 1) {
+			nlen = (int)sizeof(_name) - 1;
+		}
 		if (nlen > 0) {
 			memcpy(_name, &app_data[i], nlen);
 			_name[nlen] = 0;