瀏覽代碼

Fix overwrite in ProgressCode message buffer

When snprintf() if called we need to read the return value to see how
many bytes were written. Then when we call strncpy_P() through
TranslateProgress(), we need to tell the code to start writing
at byte 'len', or &msg[len]. Also we need to update the byte size
which strncpy_P() is allowed to write (64 - len).
Guðni Már Gilbert 3 年之前
父節點
當前提交
2142cb0849
共有 1 個文件被更改,包括 3 次插入3 次删除
  1. 3 3
      Firmware/mmu2.cpp

+ 3 - 3
Firmware/mmu2.cpp

@@ -636,10 +636,10 @@ void MMU2::ReportProgress(ProgressCode pc) {
     
     // Log progress - example: MMU2:P=123 EngageIdler
     char msg[64];
-    snprintf(msg, sizeof(msg), "MMU2:P=%hu", (uint16_t)pc);
+    int len = snprintf(msg, sizeof(msg), "MMU2:P=%hu", (uint16_t)pc);
     // Append a human readable form of the progress code
-    TranslateProgress((uint16_t)pc, msg, sizeof(msg));
-    
+    TranslateProgress((uint16_t)pc, &msg[len], 64 - len);
+
     SERIAL_ECHO_START;
     SERIAL_ECHOLN(msg);
 }