Skip to content

Commit 6beee52

Browse files
authored
Fix buffer overflow (#266)
Confirmed the location of the frag_queue.message_buffer pointer should remain static, but is being moved upon reception of non-fragmented payloads marked EXTERNAL_DATA_TYPE
1 parent a58d5a8 commit 6beee52

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

RF24Network.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -511,7 +511,7 @@ uint8_t ESBNetwork<radio_t>::enqueue(RF24NetworkHeader* header)
511511
if (header->type == EXTERNAL_DATA_TYPE)
512512
{
513513
memcpy((char*)(&frag_queue), &frame_buffer, 8);
514-
frag_queue.message_buffer = frame_buffer + sizeof(RF24NetworkHeader);
514+
memcpy(frag_queue.message_buffer, frame_buffer + sizeof(RF24NetworkHeader), message_size);
515515
frag_queue.message_size = message_size;
516516
return 2;
517517
}

0 commit comments

Comments
 (0)