Skip to content

Commit

Permalink
Major Bugfix: Buffer overrun in renewAddress
Browse files Browse the repository at this point in the history
It was right there the whole time! This painful bug took forever to
find, and it sooo shouldn't have...  sizeof(contactNode) is 8, not 2...

This bug has existed since
590d4d6
on Dec 1, 2015 and caused all kinds of mayhem, since it was overwriting
a memory space that changes with changes to the code, so symptoms seemed
vary significantly.

On RPi, segfaults and odd behavior were the main issues. This will
affect all platforms, but only on RPi was it really noticeable so far.
  • Loading branch information
TMRh20 committed Mar 27, 2016
1 parent c874003 commit 0450c5c
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions RF24Mesh.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -284,7 +284,7 @@ bool RF24Mesh::requestAddress(uint8_t level){
bool goodSignal = radio.testRPD();
#endif
if(network.update() == NETWORK_POLL){
memcpy(&contactNode[pollCount],&network.frame_buffer[0],sizeof(contactNode));
memcpy(&contactNode[pollCount],&network.frame_buffer[0],sizeof(uint16_t));
++pollCount;

#if defined (MESH_DEBUG_SERIAL) || defined (MESH_DEBUG_PRINTF)
Expand Down Expand Up @@ -460,10 +460,10 @@ void RF24Mesh::setAddress(uint8_t nodeID, uint16_t address){
}

#if defined (__linux) && !defined(__ARDUINO_X86__)
if(millis()-lastFileSave > 300){
lastFileSave = millis();
//if(millis()-lastFileSave > 300){
// lastFileSave = millis();
saveDHCP();
}
//}
#endif

}
Expand Down

0 comments on commit 0450c5c

Please sign in to comment.