From 14d874f4a15653fce2902f016b1e75373afadd51 Mon Sep 17 00:00:00 2001
From: Simon Wilks <sjwilks@gmail.com>
Date: Thu, 22 Nov 2012 16:20:48 +0100
Subject: [PATCH] Fix some memory corruption bugs.

---
 apps/hott_telemetry/hott_telemetry_main.c |  8 ++++----
 apps/hott_telemetry/messages.c            |  7 ++-----
 apps/hott_telemetry/messages.h            | 10 ++++++++--
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/apps/hott_telemetry/hott_telemetry_main.c b/apps/hott_telemetry/hott_telemetry_main.c
index 515779cb5f..98ae30dfca 100644
--- a/apps/hott_telemetry/hott_telemetry_main.c
+++ b/apps/hott_telemetry/hott_telemetry_main.c
@@ -90,7 +90,7 @@ __EXPORT int hott_telemetry_main(int argc, char *argv[]);
 int hott_telemetry_thread_main(int argc, char *argv[]);
 
 static int read_data(int uart, int *id);
-static int send_data(int uart, char *buffer, int size);
+static int send_data(int uart, uint8_t *buffer, int size);
 static void uart_disable_rx(void);
 static void uart_disable_tx(void);
 static uint32_t get_uart_address(const char *device);
@@ -171,7 +171,7 @@ int read_data(int uart, int *id)
 	return OK;
 }
 
-int send_data(int uart, char *buffer, int size)
+int send_data(int uart, uint8_t *buffer, int size)
 {
 	usleep(POST_READ_DELAY_IN_USECS);
 
@@ -265,14 +265,14 @@ int hott_telemetry_thread_main(int argc, char *argv[])
 
 	messages_init();
 
-	char *buffer;
+	uint8_t buffer[MESSAGE_BUFFER_SIZE];
 	int size = 0;
 	int id = 0;
 	while (!thread_should_exit) {
 		if (read_data(uart, &id) == OK) {
 			switch(id) {
 				case ELECTRIC_AIR_MODULE:
-					build_eam_response(&buffer, &size);
+					build_eam_response(buffer, &size);
 					break;
 				default:
 					continue;	// Not a module we support.
diff --git a/apps/hott_telemetry/messages.c b/apps/hott_telemetry/messages.c
index 1ce103b125..83cc5348c6 100644
--- a/apps/hott_telemetry/messages.c
+++ b/apps/hott_telemetry/messages.c
@@ -51,7 +51,7 @@ void messages_init(void)
 	sensor_sub = orb_subscribe(ORB_ID(sensor_combined));
 }
 
-void build_eam_response(char **buffer, int *size)
+void build_eam_response(uint8_t *buffer, int *size)
 {
 	/* get a local copy of the current sensor values */
 	struct sensor_combined_s raw;
@@ -75,8 +75,5 @@ void build_eam_response(char **buffer, int *size)
 	
 	msg.stop = STOP_BYTE;
 
-	//*chunk = malloc( sizeof(char) * length);
-	//char tmp_buffer[*size];
-	*buffer = malloc(sizeof(char) * *size);
-	memcpy(*buffer, &msg, *size);
+	memcpy(buffer, &msg, *size);
 }
\ No newline at end of file
diff --git a/apps/hott_telemetry/messages.h b/apps/hott_telemetry/messages.h
index 74418fd013..2e0699acea 100644
--- a/apps/hott_telemetry/messages.h
+++ b/apps/hott_telemetry/messages.h
@@ -43,13 +43,19 @@
 
 #include <stdlib.h>
 
+/* The buffer size used to store messages. This must be at least as big as the number of
+ * fields in the largest message struct. 
+ */
+#define MESSAGE_BUFFER_SIZE 50
+
 /* The HoTT receiver demands a minimum 5ms period of silence after delivering its request. 
  * Note that the value specified here is lower than 5000 (5ms) as time is lost constucting
  * the message after the read which takes some milliseconds. 
  */
 #define POST_READ_DELAY_IN_USECS	4000 
 /* A pause of 3ms is required between each uint8_t sent back to the HoTT receiver. Much lower
-   values can be used in practise though. */
+ * values can be used in practise though. 
+ */
 #define POST_WRITE_DELAY_IN_USECS	1500
 
 // Protocol constants.
@@ -112,6 +118,6 @@ struct eam_module_msg {
 };
 
 void messages_init(void);
-void build_eam_response(char **buffer, int *size);
+void build_eam_response(uint8_t *buffer, int *size);
 
 #endif /* MESSAGES_H_ */