Last fixes + Suggestions

Author: Scavanger

src/main/fc/fc_msp.c

@@ -4201,27 +4201,32 @@ static void readMspSimulatorValues(sbuf_t *src, const int dataSize, const uint8_
 
 static mspResult_e mspProcessSimulatorCommand(sbuf_t *dst, sbuf_t *src, const int dataSize)
 {
+    if (dataSize < 2) {
+        return MSP_RESULT_ERROR;
+    }
+
     const uint8_t simMspVersion = sbufReadU8(src); // Get the Simulator MSP version
-    // Check the MSP version of simulator
     if (simMspVersion != SIMULATOR_MSP_VERSION_2 && simMspVersion != SIMULATOR_MSP_VERSION_3) {
         return MSP_RESULT_ERROR;
     }
-    
-    // Backward compatibility for HITL Plugin 1.X
-    simulatorData.flags = sbufReadU8(src);
 
     if (simMspVersion == SIMULATOR_MSP_VERSION_3) {
-        simulatorData.flags |= ((uint16_t)sbufReadU8(src)) << 8;
+        if (dataSize < 3) {
+            return MSP_RESULT_ERROR;
+        }
+        simulatorData.flags = sbufReadU16(src);
+    } else {
+        simulatorData.flags = sbufReadU8(src);
     }
-    
-    // In case of SITL mode, we do not read any input from the simulator (done vis DREFs)
+
+    const int remainingPayload = (int)sbufBytesRemaining(src);
+
     if (!SIMULATOR_HAS_OPTION(HITL_SITL_MODE)) {
-        // Check if simulator is disabled and was previously enabled (flags != 0)
         if (!SIMULATOR_HAS_OPTION(HITL_ENABLE) && simulatorData.flags) {
             fcReboot(false);
             return MSP_RESULT_NO_REPLY;
         } else {
-            readMspSimulatorValues(src, dataSize, simMspVersion);
+            readMspSimulatorValues(src, remainingPayload, simMspVersion);
         }
     }
 

src/main/target/SITL/sim/xplane.c

@@ -303,7 +303,7 @@ static bool receiveSingleDref(dref_t in_dref, float* value)
         return false;
     }
 
-    if (strncmp((char*)buf, "RREF", 4) != 0) {
+    if (recvLen < 5 || strncmp((char*)buf, "RREF", 4) != 0) {
         return false;
     }
 
@@ -572,12 +572,12 @@ static void exchangeDataWithXPlane(void)
     );
 
     if (inavXitlDrefVersion >= XITL_DREF_VERSION) {
-        if (rangefinderAltitude == 0xff) {
+        if (rangefinderAltitude == 0xffff) {
             fakeRangefindersSetData(-1);
         } else {
             fakeRangefindersSetData(rangefinderAltitude);
         }
-    } else if (inavXitlDrefVersion < XITL_DREF_VERSION) {
+    } else {
         // Use AGL from X-Plane as rangefinder input
         const int32_t altitideOverGround = (int32_t)roundf(agl * 100);
         if (altitideOverGround > 0 &&
@@ -625,7 +625,7 @@ static void exchangeDataWithXPlane(void)
             constrainToInt16(magY * 1024.0f),
             constrainToInt16(magZ * 1024.0f)
         );
-    } else if (inavXitlDrefVersion >= XITL_DREF_VERSION) {
+    } else {
         fakeBattSensorSetVbat(16.8f * 100);
 
         fpQuaternion_t quat;
@@ -653,7 +653,6 @@ static void* listenWorker(void* arg)
         switch (connectionState) {
             case CONNECTING:
 
-                
                 // First register all DREFs with 0 freq to clear previous ones
                 registerCommonDrefs(0);
                 registerInavXitlDrefs(0);