altos: Bounds check Skytraq GPS tracking data array

[fw/altos] / src / ao_gps_skytraq.c

diff --git a/src/ao_gps_skytraq.c b/src/ao_gps_skytraq.c
index c822f7fab57bf2125922f3fac5263369d74dcaf2..2d3d464c881fa79342cfc1b3b79e5da203ce9386 100644 (file)
--- a/src/ao_gps_skytraq.c
+++ b/src/ao_gps_skytraq.c
@@ -333,14 +333,19 @@ ao_gps(void) __reentrant
                        ao_gps_skip_field();    /* sats in view */
                        while (ao_gps_char != '*' && ao_gps_char != '\n' && ao_gps_char != '\r') {
                                i = ao_gps_tracking_next.channels;
-                               ao_gps_tracking_next.sats[i].svid = ao_gps_decimal(2);  /* SVID */
+                               c = ao_gps_decimal(2);  /* SVID */
+                               if (i < AO_MAX_GPS_TRACKING)
+                                       ao_gps_tracking_next.sats[i].svid = c;
                                ao_gps_lexchar();
                                ao_gps_skip_field();    /* elevation */
                                ao_gps_lexchar();
                                ao_gps_skip_field();    /* azimuth */
-                               if (!(ao_gps_tracking_next.sats[i].c_n_1 = ao_gps_decimal(2)))  /* C/N0 */
-                                       ao_gps_tracking_next.sats[i].svid = 0;
-                               ao_gps_tracking_next.channels = i + 1;
+                               c = ao_gps_decimal(2);  /* C/N0 */
+                               if (i < AO_MAX_GPS_TRACKING) {
+                                       if (!(ao_gps_tracking_next.sats[i].c_n_1 = c))
+                                               ao_gps_tracking_next.sats[i].svid = 0;
+                                       ao_gps_tracking_next.channels = i + 1;
+                               }
                        }
                        if (ao_gps_char == '*') {
                                uint8_t cksum = ao_gps_cksum ^ '*';