mirror of
https://github.com/liquidraver/ZephCore.git
synced 2026-09-10 07:56:05 +00:00
liquidraver
988b438ec3
Two polish items from BLE audit Phase 2B: 1. CMD_SEND_TELEMETRY_REQ self-response buffer was uint8_t rsp[96] with a comment claiming 70 B worst case. Actual worst case at POWER_MAX_CHANNELS=4 is 82 B; if the channel cap ever grew the buffer would silently overflow. Replaced with a sizeof-style expression that tracks POWER_MAX_CHANNELS, plus an 8-byte safety pad. No size change today (90 vs. 96) but the upper bound auto- tracks any future bump. 2. CMD_GET_CUSTOM_VARS used `dp += snprintf(dp, 20, ...)` which advances by the would-be-written length, not bytes actually written. Currently safe only because gps_interval is capped ≤86400, but if either cap drifted or a new key was added the length passed to writeFrame would include uninitialized stack bytes between the truncation point and the (over-advanced) dp. Now tracks rsp_end, computes remaining per snprintf, and only advances dp on real progress. Both are correctness polish, not exploitable today.