Skip to content

Fix possible buffer overflow in computeDshotDMA function #300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
valeriyvan wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Fix possible buffer overflow in computeDshotDMA function #300

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
171c3eb
Add doc comment for computeDshotDMA function
valeriyvan Jan 15, 2026
258f968
Fix possible buffer overflow in computeDshotDMA function
valeriyvan Jan 15, 2026
92491ac
Shorten doc comment
valeriyvan Mar 1, 2026
f86c027
Merge branch 'main' into dshot-buffer-overflow
AlkaMotors Mar 11, 2026
4fb05ed
Merge branch 'main' into dshot-buffer-overflow
valeriyvan Nov 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions Src/dshot.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,15 @@ uint8_t programming_mode;
uint16_t position;
uint8_t new_byte;

/**
* Decode and process DShot protocol data from DMA buffer.
*
* Programming mode (4-step command sequence):
* - Step 0: Receive DShot command 36 to activate programming mode
* - Step 1: Receive EEPROM buffer position (0-191)
* - Step 2: Receive new byte value to write
* - Step 3: Receive confirmation value 37 to commit
*/
void computeDshotDMA()
{
dshot_frametime = dma_buffer[31] - dma_buffer[0];
Expand Down Expand Up @@ -107,10 +116,16 @@ void computeDshotDMA()
if (dpulse[11] == 1) {
send_telemetry = 1;
}
if(programming_mode > 0){
if(programming_mode == 1){ // begin programming mode
position = tocheck; // eepromBuffer position
programming_mode = 2;
if (programming_mode > 0) {
if (programming_mode == 1) { // begin programming mode
if (tocheck < sizeof(eepromBuffer.buffer)) {
position = tocheck; // eepromBuffer position
programming_mode = 2;
} else {
// Invalid position - reset to safe state and signal error
programming_mode = 0;
playBeaconTune3(); // Signal error with beep
}
return;
}
if(programming_mode == 2){
Expand All @@ -120,8 +135,11 @@ void computeDshotDMA()
}
if(programming_mode == 3){
if(tocheck == 37){ // commit new values to eeprom. must use save settings to make permanent.
eepromBuffer.buffer[position] = new_byte;
programming_mode = 0;
// Safety check: verify position is still in bounds before write
if (position < sizeof(eepromBuffer.buffer)) {
eepromBuffer.buffer[position] = new_byte;
}
programming_mode = 0;
}
}
return; // don't process dshot signal when in programming mode
Expand Down
Loading