From bbf107d62c08ef4558cf69a109d7573a226f76d0 Mon Sep 17 00:00:00 2001 From: Jakub <106778416+MarekZegare4@users.noreply.github.com> Date: Wed, 2 Sep 2026 13:11:59 +0200 Subject: [PATCH] fix(ui): tighten showPathDetail()'s hop_count clamp to match hash_size hop_count was clamped to MAX_HIST_PATH_BYTES regardless of hash_size, but path[] is only MAX_HIST_PATH_BYTES bytes total -- with hash_size>1 the old clamp let i*hash_size run past the buffer in resolveHopName(). Not reachable today since capturePath()/markChannelRelayed() already bound hop_count to MAX_HIST_PATH_BYTES/hash_size on write, but the reader shouldn't rely on writer discipline alone. Now clamps to the same MAX_HIST_PATH_BYTES/hash_size bound. Co-Authored-By: Claude Sonnet 5 --- examples/companion_radio/ui-new/MessagesScreen.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/examples/companion_radio/ui-new/MessagesScreen.h b/examples/companion_radio/ui-new/MessagesScreen.h index 601cbc62..3f25a94b 100644 --- a/examples/companion_radio/ui-new/MessagesScreen.h +++ b/examples/companion_radio/ui-new/MessagesScreen.h @@ -374,7 +374,8 @@ class MessagesScreen : public UIScreen { uint8_t hash_size = (path_len_packed >> 6) + 1; uint8_t hop_count = path_len_packed & 63; if (hop_count == 0) return; - if (hop_count > MAX_HIST_PATH_BYTES) hop_count = MAX_HIST_PATH_BYTES; // matches _path_detail_names capacity + uint8_t max_hops = MAX_HIST_PATH_BYTES / hash_size; // matches capturePath()/markChannelRelayed()'s write-side bound + if (hop_count > max_hops) hop_count = max_hops; for (uint8_t i = 0; i < hop_count; i++) { resolveHopName(&path[i * hash_size], hash_size, _path_detail_names[i], sizeof(_path_detail_names[i])); }