Skip to content

Fix buffer overflow#266

Merged
TMRh20 merged 1 commit intomasterfrom
fixBufferOverflow
Apr 8, 2026
Merged

Fix buffer overflow#266
TMRh20 merged 1 commit intomasterfrom
fixBufferOverflow

Conversation

@TMRh20
Copy link
Copy Markdown
Member

@TMRh20 TMRh20 commented Apr 7, 2026

  • Confirmed the location of the frag_queue.message_buffer pointer should remain static, but is being moved upon reception of non-fragmented payloads marked EXTERNAL_DATA_TYPE
  • Simple testing confirms the initial location of the pointer via Serial.println(reinterpret_cast<uintptr_t>(network.frag_ptr->message_buffer), HEX); ,subsequent change upon receiving certain payloads, and the fact that it doesn't change back.
  • Use memcpy instead

closes #265

Confirmed the location of the frag_queue.message_buffer pointer should remain static, but is being moved  upon reception of non-fragmented payloads marked EXTERNAL_DATA_TYPE
@TMRh20 TMRh20 requested a review from 2bndy5 April 8, 2026 00:07
@TMRh20 TMRh20 merged commit 6beee52 into master Apr 8, 2026
22 checks passed
@TMRh20 TMRh20 deleted the fixBufferOverflow branch April 8, 2026 00:11
@TMRh20
Copy link
Copy Markdown
Member Author

TMRh20 commented Apr 8, 2026

Since this issue only affects Arduino devices and mostly has to be triggered by an incoming, non-fragmented, CRC-validated payload labelled EXTERNAL_DATA_TYPE, I'm going to hold off on doing a release. I want to get some changes in that affect nRF52 and nRF54 devices hanging up during calls to network.write() but of course need to test some stuff.

@TMRh20
Copy link
Copy Markdown
Member Author

TMRh20 commented Apr 8, 2026

OK, from what I can tell, the nRF52/nRF54 hangs were caused by the overflows. Time for a release crusade I think!

@2bndy5
Copy link
Copy Markdown
Member

2bndy5 commented Apr 9, 2026

I see you did the release crusade. And All CI completed successfully. Well, I fixed the one docs CI that failed, but all others worked!

@TMRh20
Copy link
Copy Markdown
Member Author

TMRh20 commented Apr 9, 2026

Yup, I went with a "minor" bump due to nRF54l15 support.

You should see the difference in network functionality!
Every single node I've upgraded has remained stable for a few days now without fail. Nodes without the upgrades are unstable, due to what appears to be a lousy hacker, still trying to cause problems via non-fragmented EXTERNAL_DATA_TYPE payloads.

The other RF24 core based changes are keeping things alive as well, although seems to be returning some false-positives when FAILURE_HANDLING is invoked fully, my node keeps working even though it has no way to recover from a full radio failure. I am showing 41 failureRecoveryAttempts & 5 full on failures, but the system is still working!

I'm also showing Accepted_Conns - Delayed_Conns == 0 throughout the last days of testing as well on my RF24Ethernet server!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Possible pointer error & corruption with non-fragmented external payloads

2 participants