Mirror/betaflight
1
0
Fork 0
mirror of https://github.com/betaflight/betaflight.git synced 2025-07-13 19:40:31 +03:00
Code Issues Wiki Activity

MSP - fix buffers in MSP_MULTIPLE_MSP (#13881)

Browse source 
Fix case when MSP command fills all available space
This commit is contained in:
Petr Ledvina 2024-09-07 18:49:09 +02:00 • committed by GitHub
parent bb353e76bb
commit dab60e3093
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/main/msp/msp.c
View file

@ -2374,30 +2374,29 @@ static mspResult_e mspFcProcessOutCommandWithArg(mspDescriptor_t srcDesc, int16_
if (sbufBytesRemaining(src) == 0) { if (sbufBytesRemaining(src) == 0) {
return MSP_RESULT_ERROR; return MSP_RESULT_ERROR;
} }
int bytesRemaining = sbufBytesRemaining(dst) - 1; // need to keep one byte for checksum int bytesRemaining = sbufBytesRemaining(dst);
mspPacket_t packetIn, packetOut; mspPacket_t packetIn, packetOut;
sbufInit(&packetIn.buf, src->end, src->end); sbufInit(&packetIn.buf, src->end, src->end); // there is no paramater for MSP_MULTIPLE_MSP
uint8_t* resetInputPtr = src->ptr; uint8_t* initialInputPtr = src->ptr;
while (sbufBytesRemaining(src) && bytesRemaining > 0) { while (sbufBytesRemaining(src) && bytesRemaining > 0) {
uint8_t newMSP = sbufReadU8(src); uint8_t newMSP = sbufReadU8(src);
sbufInit(&packetOut.buf, dst->ptr, dst->end); sbufInit(&packetOut.buf, dst->ptr + 1, dst->end); // reserve 1 byte for length
packetIn.cmd = newMSP; packetIn.cmd = newMSP;
mspFcProcessCommand(srcDesc, &packetIn, &packetOut, NULL); mspFcProcessCommand(srcDesc, &packetIn, &packetOut, NULL);
uint8_t mspSize = sbufPtr(&packetOut.buf) - dst->ptr; uint8_t mspSize = sbufPtr(&packetOut.buf) - dst->ptr; // length included
mspSize++; // need to add length information for each MSP
bytesRemaining -= mspSize; bytesRemaining -= mspSize;
if (bytesRemaining >= 0) { if (bytesRemaining >= 0) {
maxMSPs++; maxMSPs++;
} }
} }
src->ptr = resetInputPtr; src->ptr = initialInputPtr;
sbufInit(&packetOut.buf, dst->ptr, dst->end); sbufInit(&packetOut.buf, dst->ptr, dst->end);
for (int i = 0; i < maxMSPs; i++) { for (int i = 0; i < maxMSPs; i++) {
uint8_t* sizePtr = sbufPtr(&packetOut.buf); uint8_t* sizePtr = sbufPtr(&packetOut.buf);
sbufWriteU8(&packetOut.buf, 0); // dummy sbufWriteU8(&packetOut.buf, 0); // placeholder for reply size
packetIn.cmd = sbufReadU8(src); packetIn.cmd = sbufReadU8(src);
mspFcProcessCommand(srcDesc, &packetIn, &packetOut, NULL); mspFcProcessCommand(srcDesc, &packetIn, &packetOut, NULL);
(*sizePtr) = sbufPtr(&packetOut.buf) - (sizePtr + 1); *sizePtr = sbufPtr(&packetOut.buf) - (sizePtr + 1);
} }
dst->ptr = packetOut.buf.ptr; dst->ptr = packetOut.buf.ptr;
} }