Mirror/ardupilot
5
0
Fork 0
mirror of https://github.com/ArduPilot/ardupilot synced 2025-02-02 14:08:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

AP_Mount: make a copy of ID for mavlink_msg_param_set_send

Browse Source 
The send function is expecting an array of the full length, so passing i
na null-terminated char* may result in uninitialised data (or
information leak)
This commit is contained in:
Peter Barker 2018-10-19 09:53:32 +11:00 committed by Andrew Tridgell
parent 83f4f5c347
commit 0142265f67
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libraries/AP_Mount/SoloGimbal_Parameters.cpp
View File

@ -109,7 +109,13 @@ void SoloGimbal_Parameters::set_param(gmb_param_t param, float value) {
_params[param].state = GMB_PARAMSTATE_ATTEMPTING_TO_SET;
_params[param].value = value;
mavlink_msg_param_set_send(_chan, 0, MAV_COMP_ID_GIMBAL, get_param_name(param), _params[param].value, MAV_PARAM_TYPE_REAL32);
// make a temporary copy of the ID; mavlink_msg_param_set_send
// expects an array of the full length
char tmp_name[MAVLINK_MSG_PARAM_SET_FIELD_PARAM_ID_LEN+1] {};
strncpy(tmp_name, get_param_name(param), sizeof(tmp_name));
mavlink_msg_param_set_send(_chan, 0, MAV_COMP_ID_GIMBAL, tmp_name, _params[param].value, MAV_PARAM_TYPE_REAL32);
_last_request_ms = AP_HAL::millis();
}