{"action":"created","issue":{"url":"https://api.github.com/repos/ArduPilot/pymavlink/issues/97","repository_url":"https://api.github.com/repos/ArduPilot/pymavlink","labels_url":"https://api.github.com/repos/ArduPilot/pymavlink/issues/97/labels{/name}","comments_url":"https://api.github.com/repos/ArduPilot/pymavlink/issues/97/comments","events_url":"https://api.github.com/repos/ArduPilot/pymavlink/issues/97/events","html_url":"https://github.com/ArduPilot/pymavlink/issues/97","id":246420932,"number":97,"title":"fatal: memory overflow if length=0 with limited buffer size","user":{"login":"az0uz","id":9094752,"avatar_url":"https://avatars2.githubusercontent.com/u/9094752?v=4","gravatar_id":"","url":"https://api.github.com/users/az0uz","html_url":"https://github.com/az0uz","followers_url":"https://api.github.com/users/az0uz/followers","following_url":"https://api.github.com/users/az0uz/following{/other_user}","gists_url":"https://api.github.com/users/az0uz/gists{/gist_id}","starred_url":"https://api.github.com/users/az0uz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/az0uz/subscriptions","organizations_url":"https://api.github.com/users/az0uz/orgs","repos_url":"https://api.github.com/users/az0uz/repos","events_url":"https://api.github.com/users/az0uz/events{/privacy}","received_events_url":"https://api.github.com/users/az0uz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-07-28T18:11:56Z","updated_at":"2017-07-31T21:48:57Z","closed_at":null,"body":"In the C API v2.0, helper receive function `mavlink_frame_char_buffer`:\r\nfile: `generator/C/include_v2.0/mavlink_helpers.h`\r\n\r\nIn case of a glitchy packet with a `len` field value of `0` (or if you would have defined a message of length zero), and MAVLINK_MAX_PAYLOAD_LEN smaller than 249 (it is rounded to the next 8 bytes alignement, not sure if that's a good idea, so effectively 256 bytes):\r\n\r\nThe state machine doesn't handle correctly a null length:\r\nIn my case this happens because of a glitchy reception that changed the `len` field to zero (I don't have any zero-length messages) which happens every few minutes given my external conditions.\r\n\r\nwhen it get to the state `MAVLINK_PARSE_STATE_GOT_MSGID3` (line 714)\r\nThe code read the first byte even if `len==0` and test `status->packet_idx == rxmsg->len` only after reading this first byte witch will be only true after reading 256 bytes instead of 0.\r\n\r\nif you used `MAVLINK_MAX_PAYLOAD_LEN` to reduced the size of the buffer, their will be bytes overriding an unknown segment of memory witch leads to undefined behavior.\r\n\r\nIn my case using it on a atmega mcu it totally freezes the execution.\r\n"},"comment":{"url":"https://api.github.com/repos/ArduPilot/pymavlink/issues/comments/319206576","html_url":"https://github.com/ArduPilot/pymavlink/issues/97#issuecomment-319206576","issue_url":"https://api.github.com/repos/ArduPilot/pymavlink/issues/97","id":319206576,"user":{"login":"az0uz","id":9094752,"avatar_url":"https://avatars2.githubusercontent.com/u/9094752?v=4","gravatar_id":"","url":"https://api.github.com/users/az0uz","html_url":"https://github.com/az0uz","followers_url":"https://api.github.com/users/az0uz/followers","following_url":"https://api.github.com/users/az0uz/following{/other_user}","gists_url":"https://api.github.com/users/az0uz/gists{/gist_id}","starred_url":"https://api.github.com/users/az0uz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/az0uz/subscriptions","organizations_url":"https://api.github.com/users/az0uz/orgs","repos_url":"https://api.github.com/users/az0uz/repos","events_url":"https://api.github.com/users/az0uz/events{/privacy}","received_events_url":"https://api.github.com/users/az0uz/received_events","type":"User","site_admin":false},"created_at":"2017-07-31T21:48:57Z","updated_at":"2017-07-31T21:48:57Z","body":"No I haven't any, I am running the code on an atmega32u4 MCU without real debugging tools but I managed to track down what was wrong using Serial and I fixed the issue, You can review Merge Request #98.\r\nTo reproduce, set MAVLINK_MAX_PAYLOAD_LEN to, say, 64 bytes, and send any message but replace the length field by 0."}}
{"actor":{"display_login":"az0uz"}}