From 3d6385c527c66fc679bee8c32143649f1879d0e9 Mon Sep 17 00:00:00 2001
From: vivek-shankar <robovivek@gmail.com>
Date: Mon, 30 Jan 2017 18:58:21 -0500
Subject: [PATCH] crash fix for wrong memory index

---
 src/CommunicationManager.cpp | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/src/CommunicationManager.cpp b/src/CommunicationManager.cpp
index e1b4c34..a61007b 100644
--- a/src/CommunicationManager.cpp
+++ b/src/CommunicationManager.cpp
@@ -697,15 +697,17 @@ inline void CommunicationManager::Send_Mavlink_Message_Callback(
 			//std::cout << "put header in dict" <<header_16[0]<<"  "<<header_16[1]<<"  "<<header_16[2]<<"  "<<header_16[3]<<"  "<< std::endl;
 					
 			/*copy msg size*/
+			
 			uint16_t tmp_size=(uint16_t)MAX_NBR_OF_INT64;
 			uint16_t uint64_counter=0;
+			
 			/*Multi message frame received, split them into chunks and store them in dict*/
-			for (uint16_t i =1; i<total; i++)
+			while(number!=total)
 			{
 					/*Copy the header*/
 					memcpy(cpy_buff,&header,sizeof(uint64_t));
 					tot+=sizeof(uint64_t);			
-					memcpy(cpy_buff+tot,&tmp_size,sizeof(uint64_t));
+					memcpy(cpy_buff+tot,&tmp_size,sizeof(uint16_t));
 					tot+=sizeof(uint16_t);
 					/*Copy obt msg*/
 					memcpy(cpy_buff+tot, message_obt+uint64_counter, ( sizeof(uint64_t) )*tmp_size);
@@ -731,6 +733,9 @@ inline void CommunicationManager::Send_Mavlink_Message_Callback(
 					//usleep(1000);
 					//std::cout << "Frame:"<<frame << std::endl;
 					//std::cout << "size of frame:"<<std::strlen(temporary_buffer)<< std::endl;
+					if(mavlink_msg->payload64.size() - uint64_counter >= MAX_NBR_OF_INT64)
+					tmp_size=(uint16_t)MAX_NBR_OF_INT64;
+					else tmp_size = mavlink_msg->payload64.size() - uint64_counter;
 					tot =0;					
 					number++;
 					frame = "";
@@ -749,22 +754,22 @@ inline void CommunicationManager::Send_Mavlink_Message_Callback(
 						
 			}
 			delete[] header_16;
-			if(uint64_counter!=mavlink_msg->payload64.size()){
-				tmp_size=mavlink_msg->payload64.size() - uint64_counter;
+		/*	if(uint64_counter!=mavlink_msg->payload64.size()){
+				tmp_size=mavlink_msg->payload64.size() - uint64_counter; */
 				/*Copy the header*/
-				memcpy(cpy_buff,&header,sizeof(uint64_t));
+			/*	memcpy(cpy_buff,&header,sizeof(uint64_t));
 				tot+=sizeof(uint64_t);			
 				memcpy(cpy_buff+tot,&tmp_size,sizeof(uint64_t));
-				tot+=sizeof(uint16_t);
+				tot+=sizeof(uint16_t);*/
 				/*Copy obt msg*/
-				memcpy(cpy_buff+tot, message_obt+uint64_counter, ( sizeof(uint64_t) )*tmp_size);
+			/*	memcpy(cpy_buff+tot, message_obt+uint64_counter, ( sizeof(uint64_t) )*tmp_size);
 				uint64_counter+=tmp_size;
-				tot+=( sizeof(uint64_t) )*tmp_size;
+				tot+=( sizeof(uint64_t) )*tmp_size;*/
 				/*Copy the data to char buff*/
-				memcpy((void*)temporary_buffer,(void*)cpy_buff,tot);
+			/*	memcpy((void*)temporary_buffer,(void*)cpy_buff,tot);
 				Generate_Transmit_Request_Frame(temporary_buffer, &frame,tot);
 				multi_msgs_send_dict.push_back(frame);
-			}
+			}*/
 			delete[] cpy_buff;
 			//std::cout << " Received size: " <<mavlink_msg->payload64.size() << std::endl;
 			//std::cout << "total size of multi msg dict mavlink size:" <<multi_msgs_send_dict.size() << std::endl;