Mirrors/MeshCore-Solo
1
0
Fork 0
mirror of https://github.com/MarekZegare4/MeshCore-Solo.git synced 2026-07-26 14:58:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: smaller audit items — strnlen, narrow-display guard, SNR precision

Browse Source 
M2: CMD_SET_DEFAULT_FLOOD_SCOPE used strlen() on the frame's 31-byte name
slot, which is not required to be NUL-terminated. Switched to strnlen()
so the search can't run past the field into the 16-byte key.

M4: NearbyScreen::renderDiscoverDetail computed strncpy(b64, ..., max_chars - 3)
where max_chars came from display width. On very narrow displays (width < ~28
at 6 px font) this became negative. Skip the pub-key line entirely when
max_chars < 4 so we don't risk a negative count and a bogus terminator.

L1: SNR was shown as truncated integer dB. Switched the detail view and
the 2-line discover cards to %.1f so they keep the 0.25 dB resolution
(consistent with the ping popup, which already used %.1f).

L4: Two fallback "?" sender placeholders used strncpy(buf, "?", sizeof(buf))
— functional but it memsets 21 unused bytes for a one-character string.
Replaced with strcpy.

M1 marked as not-a-bug after re-check: default_scope_name is char[31],
so the n < 31 guard correctly admits the max 30-char string + NUL.

FEATURES.md audit section updated with current status.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Jakub
2026-05-31 00:11:43 +02:00
parent 9113b7f12e
commit e578300eff
4 changed files with 41 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
examples/companion_radio/MyMesh.cpp
View File

@@ -2139,7 +2139,10 @@ void MyMesh::handleCmdFrame(size_t len) {
writeOKFrame();
} else if (cmd_frame[0] == CMD_SET_DEFAULT_FLOOD_SCOPE && len >= 1) {
if (len >= 1+31+16) {
int n = strlen((char *) &cmd_frame[1]);
// strnlen, not strlen: the name field is always 31 bytes in the frame
// even if the actual name is shorter, so we must bound the search to
// avoid reading into the key (or past the frame) when no NUL is present.
int n = (int)strnlen((char *) &cmd_frame[1], 31);
if (n > 0 && n < 31) {
strcpy(_prefs.default_scope_name, (char *) &cmd_frame[1]);
memcpy(_prefs.default_scope_key, &cmd_frame[1+31], 16);

19
examples/companion_radio/ui-new/NearbyScreen.h
View File

@@ -328,7 +328,12 @@ class NearbyScreen : public UIScreen {
int max_chars = (display.width() - 4) / display.getCharWidth();
int b64_len = strlen(b64);
char b64_line[48];
if (b64_len > max_chars) {
// Need at least 4 chars (one char + "..." ellipsis) to display anything
// meaningful; on a very narrow display skip the pubkey line entirely
// rather than risk a negative strncpy length.
if (max_chars < 4) {
b64_line[0] = '\0';
} else if (b64_len > max_chars) {
strncpy(b64_line, b64, max_chars - 3);
b64_line[max_chars - 3] = '\0';
strcat(b64_line, "...");
@@ -336,8 +341,10 @@ class NearbyScreen : public UIScreen {
strncpy(b64_line, b64, sizeof(b64_line) - 1);
b64_line[sizeof(b64_line) - 1] = '\0';
}
display.setCursor(2, hdr);
display.print(b64_line);
if (b64_line[0]) {
display.setCursor(2, hdr);
display.print(b64_line);
}
}
int step = display.lineStep();
@@ -345,9 +352,9 @@ class NearbyScreen : public UIScreen {
char buf[32];
snprintf(buf, sizeof(buf), "RSSI: %d dBm", (int)r.rssi);
display.setCursor(2, hdr + step); display.print(buf);
snprintf(buf, sizeof(buf), "SNR: %d dB", (int)(r.snr_x4 / 4));
snprintf(buf, sizeof(buf), "SNR: %.1f dB", r.snr_x4 / 4.0f);
display.setCursor(2, hdr + step * 2); display.print(buf);
snprintf(buf, sizeof(buf), "Rem: %d dB", (int)(r.remote_snr_x4 / 4));
snprintf(buf, sizeof(buf), "Rem: %.1f dB", r.remote_snr_x4 / 4.0f);
display.setCursor(2, hdr + step * 3); display.print(buf);
display.setCursor(2, hdr + step * 4);
display.print(r.is_known ? "Status: known" : "Status: new");
@@ -477,7 +484,7 @@ class NearbyScreen : public UIScreen {
// body: RSSI + SNR
display.setColor(sel ? DisplayDriver::DARK : DisplayDriver::LIGHT);
char sig[24];
snprintf(sig, sizeof(sig), "RSSI:%d SNR:%d", (int)r.rssi, (int)(r.snr_x4 / 4));
snprintf(sig, sizeof(sig), "RSSI:%d SNR:%.1f", (int)r.rssi, r.snr_x4 / 4.0f);
display.drawTextEllipsized(3, y + lh + 2, display.width() - 6, sig);
}

4
examples/companion_radio/ui-new/QuickMsgScreen.h
View File

@@ -784,7 +784,7 @@ public:
strncpy(fsender, ftext, nl); fsender[nl] = '\0';
strncpy(fmsg, fsep + 2, sizeof(fmsg) - 1); fmsg[sizeof(fmsg)-1] = '\0';
} else {
strncpy(fsender, "?", sizeof(fsender));
strcpy(fsender, "?");
strncpy(fmsg, ftext, sizeof(fmsg) - 1); fmsg[sizeof(fmsg)-1] = '\0';
}
int ret = _fs.render(display, fsender, fmsg,
@@ -857,7 +857,7 @@ public:
strncpy(msg_part, sep + 2, sizeof(msg_part) - 1);
msg_part[sizeof(msg_part) - 1] = '\0';
} else {
strncpy(sender, "?", sizeof(sender));
strcpy(sender, "?");
strncpy(msg_part, text, sizeof(msg_part) - 1);
msg_part[sizeof(msg_part) - 1] = '\0';
}