Cole Munz 5dc7187085 Infrared: initialize timings_cnt on decoder alloc and fix its bounds check (#4429) ...

infrared_common_decoder_alloc() sets protocol and level but leaves
timings_cnt uninitialized. Every caller allocs then resets, and for RC5
(the one protocol with preamble_mark == 0) the reset path reads
timings_cnt and feeds it to consume_samples() as a length before the
reset function zeroes it a few lines later. With a nonzero garbage value
that shifts the 6-element timings[] array out of bounds, both read and
write.

Separately, the bounds check in infrared_common_decode() compares
timings_cnt (an element count) against sizeof(decoder->timings) (24
bytes for six uint32_t), so it doesn't fire until 24 instead of 6.
Should be COUNT_OF.

Both come down to timings_cnt not being trustworthy; init it at alloc and
use the element count in the check.

Signed-off-by: Cole Munz <colemunz@gmail.com>

2026-07-27 17:59:05 +03:00

..

common

…

kaseikyo

…

nec

…

pioneer

…

rc5

…

rc6

…

rca

…

samsung

…

sirc

…

infrared_i.h

…

infrared.c

…

infrared.h

…