Jacob Dahl 05cc1687a5 fix(crsf_rc): guard against packet_size underflow in CRSF parser ...

When a CRSF frame arrives with packet_size < 2 (PACKET_SIZE_TYPE_SIZE),
the subtraction `packet_size - PACKET_SIZE_TYPE_SIZE` underflows the
uint32_t working_segment_size to 0xFFFFFFFF. The subsequent overflow
check also wraps and fails to catch it. Since working_segment_size is
static, the parser is permanently stalled — no further CRSF messages
can be processed until reboot.

Validate packet_size >= PACKET_SIZE_TYPE_SIZE early, before any
subtraction, protecting both the known variable-length and unknown
packet branches in a single check.

Supersedes #26782 which only guarded the unknown-packet branch.

2026-03-18 16:47:57 -07:00

..

drivers

fix(crsf_rc): guard against packet_size underflow in CRSF parser

2026-03-18 16:47:57 -07:00

examples

Docs beginner tutorials update (#26639)

2026-03-05 20:18:57 +11:00

include

…

lib

fix(drivers): do not accumulate invalid current

2026-03-18 12:05:58 +01:00

modules

fix(control_allocator): add missing launch-lock rule items for servo types

2026-03-18 10:34:08 +01:00

systemcmds

module_base: remove CRTP template pattern to reduce flash bloat (#26476)

2026-02-19 15:17:17 +13:00

templates/template_module

templates: fix ModuleBase template (#26617)

2026-03-02 13:21:23 -09:00