Skip to content

Fix companion crash on a short CMD_SEND_CHANNEL_TXT_MSG frame #3643

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ripplebiz merged 1 commit into from
Oct 24, 2026
+8 −1
Merged

Fix companion crash on a short CMD_SEND_CHANNEL_TXT_MSG frame #3643

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion examples/companion_radio/MyMesh.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1175,7 +1175,9 @@ void MyMesh::handleCmdFrame(size_t len) {
? ERR_CODE_NOT_FOUND
: ERR_CODE_UNSUPPORTED_CMD); // unknown recipient, or unsupported TXT_TYPE_*
}
} else if (cmd_frame[0] == CMD_SEND_CHANNEL_TXT_MSG) { // send GroupChannel text msg
} else if (cmd_frame[0] == CMD_SEND_CHANNEL_TXT_MSG && len >= 7) { // send GroupChannel text msg
// 7 = code, txt_type, channel_idx and the 4 byte timestamp; the text may be empty.
// Without this the text length below is computed as len - 7 and turns negative.
int i = 1;
uint8_t txt_type = cmd_frame[i++]; // should be TXT_TYPE_PLAIN
uint8_t channel_idx = cmd_frame[i++];
Expand Down
5 changes: 5 additions & 0 deletions src/helpers/BaseChatMesh.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -516,6 +516,11 @@ int BaseChatMesh::sendCommandData(const ContactInfo& recipient, uint32_t timest
}

bool BaseChatMesh::sendGroupMessage(uint32_t timestamp, mesh::GroupChannel& channel, const char* sender_name, const char* text, int text_len) {
if (text_len < 0) { // memcpy() below would read this as a size_t, so clamping cannot catch it
MESH_DEBUG_PRINTLN("sendGroupMessage: invalid negative text_len=%d", text_len);
return false;
}

uint8_t temp[5+MAX_TEXT_LEN+32];
memcpy(temp, &timestamp, 4); // mostly an extra blob to help make packet_hash unique
temp[4] = 0; // TXT_TYPE_PLAIN
Expand Down
Loading