In the lightware_parser function, LW_PARSE_STATE2_GOT_DIGIT0 state can be repeated unexpectedly without proper parserbuf_index or state checking. This behavior will trigger a heap buffer overflow vulnerability by allowing to write some data. And the writable size is sizeof(unsigned).
* ekf2_derivation: use single source of state definition
The state is defined as an ordered dictionary of group elements and
everything else is generated using that state definition
* ekf2: generated state sample add const reference getter
---------
Co-authored-by: bresch <[brescianimathieu@gmail.com](mailto:brescianimathieu@gmail.com)>
Co-authored-by: Daniel Agar <daniel@agar.ca>
The length check for unknown packets did not include PACKET_SIZE_TYPE_SIZE
and CRC_SIZE, and hence working_index could overflow CRSF_MAX_PACKET_LEN,
triggering invalid memory access further down in QueueBuffer_PeekBuffer.
Also the working_segment_size was wrong for unknown packets.
Credits for finding this go to @Pwn9uin.
This allows to inject an updated ext_autostart folder with the name
ext_autostart_new, and then PX4 takes care of renaming it to
ext_autostart during bootup.
Signed-off-by: Silvan Fuhrer <silvan@auterion.com>
The sparse vector template requires to know which states are non-zero in
the observation jacobian. This complicates the modularity of the code
when the state vector or the derivation is changed.
The computation cost difference is almost negligible for this size.
For FW takeoffs we need to keep the course straight towards the first
waypoint, and not climb in loiter patterns first.
Signed-off-by: Silvan Fuhrer <silvan@auterion.com>
Current threshhold has no margins of errors with the set acceptance radius. Increase corridor radius by 5m.
Increase time to disarm for tailsitter test to pass.
Rverse mission needs check tracks test disabled since mavsdk does not really work with mission has reverse order.
mavsdk-test: added a vtol mission without a landing at the end (used for reversed RTL)
math_helpers: added function to compute local position from a raw mission item
Signed-off-by: RomanBapst <bapstroman@gmail.com>
Dataman: Add write function to dataman cache.
RTL and mission have a new common base class mission_base. Both inherit from them and mission, RTL mission, and rtl reverse mission inherit from them and implement their desired functionalities. This simplifies the logic in mission as well as make the logic in rtl mission reverse and mission more readable.
Rtl mission reverse now functional again for VTOL flying back the mission and transitioning to MC at the home position.
Dataman cache has new write functionality to write to dataman while updating write item in its cache if necessary.
Dataman cache is now only updated when the respective module is active. Leads to a higher computation time once on activation, but decreases unnecessary cache updates when inactive.
romain-chiap
RomanBapst
ZeroOne
Daniel Agar
Serkan Mazlum
bresch
Silvan Fuhrer
Hamish Willee
Beniamino Pozzan
Mathieu Bresciani
Beat Küng
Julian Oes
Daniel Mesham
Konrad