Browse Source

fix MavlinkConsoleController: avoid buffer out-of-bound access (#10062)

mavlink_msg_serial_control_pack_chan expects
MAVLINK_MSG_SERIAL_CONTROL_FIELD_DATA_LEN bytes for 'data', but 'chuck'
might be smaller than that.
QGC4.4
Beat Küng 4 years ago committed by GitHub
parent
commit
b6bc30fef7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 2
      src/AnalyzeView/MavlinkConsoleController.cc

2
src/AnalyzeView/MavlinkConsoleController.cc

@ -143,6 +143,8 @@ MavlinkConsoleController::_sendSerialData(QByteArray data, bool close) @@ -143,6 +143,8 @@ MavlinkConsoleController::_sendSerialData(QByteArray data, bool close)
// Send maximum sized chunks until the complete buffer is transmitted
while(data.size()) {
QByteArray chunk{data.left(MAVLINK_MSG_SERIAL_CONTROL_FIELD_DATA_LEN)};
// Ensure the buffer is large enough, as the MAVLink parser expects MAVLINK_MSG_SERIAL_CONTROL_FIELD_DATA_LEN bytes
chunk.append(MAVLINK_MSG_SERIAL_CONTROL_FIELD_DATA_LEN - chunk.size(), '\0');
uint8_t flags = SERIAL_CONTROL_FLAG_EXCLUSIVE | SERIAL_CONTROL_FLAG_RESPOND | SERIAL_CONTROL_FLAG_MULTI;
if (close) flags = 0;
auto protocol = qgcApp()->toolbox()->mavlinkProtocol();

Loading…
Cancel
Save