From: Keith Packard <keithp@keithp.com>
Date: Wed, 24 Aug 2011 08:48:28 +0000 (-0700)
Subject: altosui: Don't trust companion telemetry record 'channels' count
X-Git-Tag: 1.0~24^2~2
X-Git-Url: https://git.gag.com/?p=fw%2Faltos;a=commitdiff_plain;h=9849883a754a73b861dd7be530753ff5c2abb499

altosui: Don't trust companion telemetry record 'channels' count

It can be bogus, allowing the code to walk off the end of the
allocated data array.

Signed-off-by: Keith Packard <keithp@keithp.com>
---

diff --git a/altosui/AltosTelemetryRecordCompanion.java b/altosui/AltosTelemetryRecordCompanion.java
index 11b349e1..52d7f4cf 100644
--- a/altosui/AltosTelemetryRecordCompanion.java
+++ b/altosui/AltosTelemetryRecordCompanion.java
@@ -36,7 +36,7 @@ public class AltosTelemetryRecordCompanion extends AltosTelemetryRecordRaw {
 		companion.tick		= tick;
 		companion.board_id      = uint8(5);
 		companion.update_period = uint8(6+off);
-		for (int i = 0; i < channels; i++)
+		for (int i = 0; i < companion.companion_data.length; i++)
 			companion.companion_data[i] = uint16(8 + off + i * 2);
 	}