Skip to content

Commit

Permalink
fixing a potential stack corruption
Browse files Browse the repository at this point in the history
.. overlooked this one when reviewing the PR.
@blazoncek, @ctjet : three questions on the new code remain, because its not clear to me if its correct. Please check.
  • Loading branch information
softhack007 committed Jan 3, 2023
1 parent 4a09e18 commit faf616c
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 5 deletions.
9 changes: 6 additions & 3 deletions wled00/set.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -655,9 +655,12 @@ void handleSettingsSet(AsyncWebServerRequest *request, byte subPage)
strip.panel.reserve(strip.panels); // pre-allocate memory
for (uint8_t i=0; i<strip.panels; i++) {
WS2812FX::Panel p;
char pO[8]; sprintf_P(pO, PSTR("P%d"), i);
uint8_t l = strlen(pO); pO[l+1] = 0;
pO[l] = 'B'; if (!request->hasArg(pO)) break;
char pO[8] = { '\0' };
snprintf_P(pO, 7, PSTR("P%d"), i);
pO[7] = '\0';
uint8_t l = strlen(pO);
// softhack007: please check if the code below is correct. The first element is pO[0], so maybe you want to modify pO[l-1]?
pO[l] = 'B'; if (!request->hasArg(pO)) break; // softhack007: this line looks suspicious to me .. break() aborts the loop .. maybe you need continue()?
pO[l] = 'B'; p.bottomStart = request->arg(pO).toInt();
pO[l] = 'R'; p.rightStart = request->arg(pO).toInt();
pO[l] = 'V'; p.vertical = request->arg(pO).toInt();
Expand Down
7 changes: 5 additions & 2 deletions wled00/xml.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -744,8 +744,11 @@ void getSettingsJS(byte subPage, char* dest)
oappend(SET_F("addPanel("));
oappend(itoa(i,n,10));
oappend(SET_F(");"));
char pO[8]; sprintf_P(pO, PSTR("P%d"), i);
uint8_t l = strlen(pO); pO[l+1] = 0;
char pO[8] = { '\0' };
snprintf_P(pO, 7, PSTR("P%d"), i);
pO[7] = '\0';
uint8_t l = strlen(pO);
// softhack007: please check if the code below is correct. The first element is pO[0], so maybe you want to modify pO[l-1]?
pO[l] = 'B'; sappend('v',pO,strip.panel[i].bottomStart);
pO[l] = 'R'; sappend('v',pO,strip.panel[i].rightStart);
pO[l] = 'V'; sappend('v',pO,strip.panel[i].vertical);
Expand Down

0 comments on commit faf616c

Please sign in to comment.