From ba4526ee89c2b5a946a659eea2c9581c36254809 Mon Sep 17 00:00:00 2001 From: Dennis Date: Sat, 25 Nov 2017 19:53:15 -0500 Subject: [PATCH] Fix ATMEGA BASH_SERIAL buffer overrun Changed the compare to TXBUFFER_SIZE to >= If next wasn't set to zero until > TXBUFFER_SIZE then the next time the routines get called the the array index references outside the buffer (e.g tail+1) --- Multiprotocol/Telemetry.ino | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Multiprotocol/Telemetry.ino b/Multiprotocol/Telemetry.ino index 52af18a..9b8d9bf 100644 --- a/Multiprotocol/Telemetry.ino +++ b/Multiprotocol/Telemetry.ino @@ -975,7 +975,7 @@ void Serial_write( uint8_t byte ) byte |= 1 ; // Start bit #endif uint8_t next = SerialControl.head + 2; - if(next>TXBUFFER_SIZE) + if(next>=TXBUFFER_SIZE) next=0; if ( next != SerialControl.tail ) { @@ -1069,7 +1069,7 @@ ISR(TIMER0_COMPB_vect) GPIOR0 = ptr->data[ptr->tail] ; GPIOR2 = ptr->data[ptr->tail+1] ; uint8_t nextTail = ptr->tail + 2 ; - if ( nextTail > TXBUFFER_SIZE ) + if ( nextTail >= TXBUFFER_SIZE ) nextTail = 0 ; ptr->tail = nextTail ; GPIOR1 = 8 ; @@ -1112,7 +1112,7 @@ ISR(TIMER0_OVF_vect) GPIOR0 = ptr->data[ptr->tail] ; GPIOR2 = ptr->data[ptr->tail+1] ; uint8_t nextTail = ptr->tail + 2 ; - if ( nextTail > TXBUFFER_SIZE ) + if ( nextTail >= TXBUFFER_SIZE ) nextTail = 0 ; ptr->tail = nextTail ; GPIOR1 = 10 ;