Cole Munz 5dc7187085 Infrared: initialize timings_cnt on decoder alloc and fix its bounds check (#4429) ...

infrared_common_decoder_alloc() sets protocol and level but leaves
timings_cnt uninitialized. Every caller allocs then resets, and for RC5
(the one protocol with preamble_mark == 0) the reset path reads
timings_cnt and feeds it to consume_samples() as a length before the
reset function zeroes it a few lines later. With a nonzero garbage value
that shifts the 6-element timings[] array out of bounds, both read and
write.

Separately, the bounds check in infrared_common_decode() compares
timings_cnt (an element count) against sizeof(decoder->timings) (24
bytes for six uint32_t), so it doesn't fire until 24 instead of 6.
Should be COUNT_OF.

Both come down to timings_cnt not being trustworthy; init it at alloc and
use the element count in the check.

Signed-off-by: Cole Munz <colemunz@gmail.com>

2026-07-27 17:59:05 +03:00

..

infrared_common_decoder.c

Infrared: initialize timings_cnt on decoder alloc and fix its bounds check (#4429)

2026-07-27 17:59:05 +03:00

infrared_common_encoder.c

[FL-3078] Per protocol signal repeat count (#2293)

2023-01-13 16:50:19 +03:00

infrared_common_i.h

Add support for Pioneer SR IR remotes (#3308)

2024-03-22 21:25:52 +09:00