From e9d55de3cb7e5b028a33b82146394d948a1d73ce Mon Sep 17 00:00:00 2001 From: Tom Fifield Date: Mon, 9 Sep 2024 20:54:11 +0800 Subject: [PATCH] Fix out-of-bound array access in T1000X Sensor (#4663) if u8i == 135, then u8i++ runs, the loop exits since u8i == 136, then value for u8i is 136 after the for loop. then in the next line, ntc_res2[u8i] will read past the end of the array --- src/modules/Telemetry/Sensor/T1000xSensor.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/Telemetry/Sensor/T1000xSensor.cpp b/src/modules/Telemetry/Sensor/T1000xSensor.cpp index 4079d8ae3..4772aeb9e 100644 --- a/src/modules/Telemetry/Sensor/T1000xSensor.cpp +++ b/src/modules/Telemetry/Sensor/T1000xSensor.cpp @@ -95,7 +95,7 @@ float T1000xSensor::getTemp() Vout = ntc_vot; Rt = (HEATER_NTC_RP * vcc_vot) / Vout - HEATER_NTC_RP; - for (u8i = 0; u8i < 136; u8i++) { + for (u8i = 0; u8i < 135; u8i++) { if (Rt >= ntc_res2[u8i]) { break; }