fix: validate channel index to prevent OOB crash on TFT devices#311
Merged
fix: validate channel index to prevent OOB crash on TFT devices#311
Conversation
channelGroup is declared as std::array<lv_obj_t*, 8> (valid indices 0-7), but messages with ch >= 8 could reach newMessageContainer() unchecked, causing out-of-bounds access -> lv_obj_create(NULL) -> StoreProhibited crash. Add ch >= c_max_channels guards at both ViewController entry points (live packet reception and flash restore), plus defensive guards in TFTView_320x240 messaging functions and a null-pointer check downstream. Also fix off-by-one in addChat() (index > c_max_channels -> >=). Fixes #304
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #304
kodos to @bouob, for some reason I could not commit into his PR branch so I copied PR #305
What
Add
ch >= c_max_channelsbounds checks at bothViewControllerentry points before anychannelGroupaccess, plus defensive guards insideTFTView_320x240messaging functions.Changes
ViewController.cpp(root fix)restoreTextMessages(): skip stored messages with invalid channel indexpacketReceived(): reject live packets with invalid channel indexLogMessage.h(crash fix)deserialize(): _size < messagePayloadSize check addedTesting
Tested on Heltec V4 TFT (meshtastic/firmware 2.7.22 compiled with this device-ui patch).
Tested on T-Deck Plus TFT (meshtastic/firmware 2.7.23 compiled with this device-ui patch).
Clean boot (clean LittleFS):
OOB injection (5× ch=31 entries written directly to LittleFS via script):
All 5 invalid entries intercepted, device boots normally ✅
No longer crashing when restoring text messages, device boots normally ✅