Browse Source

Fix overwrite in ProgressCode message buffer

When snprintf() if called we need to read the return value to see how
many bytes were written. Then when we call strncpy_P() through
TranslateProgress(), we need to tell the code to start writing
at byte 'len', or &msg[len]. Also we need to update the byte size
which strncpy_P() is allowed to write (64 - len).
Guðni Már Gilbert 3 years ago
parent
commit
2142cb0849
1 changed files with 3 additions and 3 deletions
  1. 3 3
      Firmware/mmu2.cpp

+ 3 - 3
Firmware/mmu2.cpp

@@ -636,10 +636,10 @@ void MMU2::ReportProgress(ProgressCode pc) {
     
     // Log progress - example: MMU2:P=123 EngageIdler
     char msg[64];
-    snprintf(msg, sizeof(msg), "MMU2:P=%hu", (uint16_t)pc);
+    int len = snprintf(msg, sizeof(msg), "MMU2:P=%hu", (uint16_t)pc);
     // Append a human readable form of the progress code
-    TranslateProgress((uint16_t)pc, msg, sizeof(msg));
-    
+    TranslateProgress((uint16_t)pc, &msg[len], 64 - len);
+
     SERIAL_ECHO_START;
     SERIAL_ECHOLN(msg);
 }