From 617f37afbf828a9dc75a1584cbfe3128fa5f101e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beat=20K=C3=BCng?= Date: Wed, 16 Oct 2019 11:35:38 +0200 Subject: [PATCH] mixer_{multicopter,helicopter}: add buffer size check Fixes a potential buffer overflow if an MC/helicopter mixer is used that exceeds the number of physical pins. This is not a useful/flyable configuration, but the system still should not crash. --- src/lib/mixer/mixer_helicopter.cpp | 4 ++++ src/lib/mixer/mixer_multirotor.cpp | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/src/lib/mixer/mixer_helicopter.cpp b/src/lib/mixer/mixer_helicopter.cpp index 87441ee7bc..c087b3a283 100644 --- a/src/lib/mixer/mixer_helicopter.cpp +++ b/src/lib/mixer/mixer_helicopter.cpp @@ -200,6 +200,10 @@ HelicopterMixer::from_text(Mixer::ControlCallback control_cb, uintptr_t cb_handl unsigned HelicopterMixer::mix(float *outputs, unsigned space) { + if (space < _mixer_info.control_count + 1u) { + return 0; + } + /* Find index to use for curves */ float thrust_cmd = get_control(0, 3); int idx = (thrust_cmd / 0.25f); diff --git a/src/lib/mixer/mixer_multirotor.cpp b/src/lib/mixer/mixer_multirotor.cpp index ce04811d9e..8559d01823 100644 --- a/src/lib/mixer/mixer_multirotor.cpp +++ b/src/lib/mixer/mixer_multirotor.cpp @@ -354,6 +354,10 @@ void MultirotorMixer::mix_yaw(float yaw, float *outputs) unsigned MultirotorMixer::mix(float *outputs, unsigned space) { + if (space < _rotor_count) { + return 0; + } + float roll = math::constrain(get_control(0, 0) * _roll_scale, -1.0f, 1.0f); float pitch = math::constrain(get_control(0, 1) * _pitch_scale, -1.0f, 1.0f); float yaw = math::constrain(get_control(0, 2) * _yaw_scale, -1.0f, 1.0f);