altosui: Don't trust companion telemetry record 'channels' count
authorKeith Packard <keithp@keithp.com>
Wed, 24 Aug 2011 08:48:28 +0000 (01:48 -0700)
committerKeith Packard <keithp@keithp.com>
Wed, 24 Aug 2011 09:04:47 +0000 (02:04 -0700)
It can be bogus, allowing the code to walk off the end of the
allocated data array.

Signed-off-by: Keith Packard <keithp@keithp.com>
altosui/AltosTelemetryRecordCompanion.java

index 11b349e..52d7f4c 100644 (file)
@@ -36,7 +36,7 @@ public class AltosTelemetryRecordCompanion extends AltosTelemetryRecordRaw {
                companion.tick          = tick;
                companion.board_id      = uint8(5);
                companion.update_period = uint8(6+off);
-               for (int i = 0; i < channels; i++)
+               for (int i = 0; i < companion.companion_data.length; i++)
                        companion.companion_data[i] = uint16(8 + off + i * 2);
        }