From f002b08e6ab76c38d8c223ac94e566bbb023d549 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Beat=20K=C3=BCng?= <beat-kueng@gmx.net>
Date: Fri, 5 Apr 2024 09:24:55 +0200
Subject: [PATCH] mavlink_ftp: ensure there's enough space for the 2. path in
 _workRename

Prevents accessing invalid memory when reading ptr + oldpath_sz + 1 and
oldpath_sz fills out the whole or N-1 bytes of the payload.
---
 src/modules/mavlink/mavlink_ftp.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/modules/mavlink/mavlink_ftp.cpp b/src/modules/mavlink/mavlink_ftp.cpp
index b85ea93b3d..74ec0762ff 100644
--- a/src/modules/mavlink/mavlink_ftp.cpp
+++ b/src/modules/mavlink/mavlink_ftp.cpp
@@ -838,7 +838,7 @@ MavlinkFTP::_workRename(PayloadHeader *payload)
 	char *ptr = _data_as_cstring(payload);
 	size_t oldpath_sz = strlen(ptr);
 
-	if (oldpath_sz == payload->size) {
+	if (oldpath_sz + 2 >= payload->size) {
 		// no newpath
 		errno = EINVAL;
 		return kErrFailErrno;