From 3986d9d1f7139b3c14f22724e63ad108b275726d Mon Sep 17 00:00:00 2001 From: pwsh <33337365+pwsh@users.noreply.github.com> Date: Mon, 12 Oct 2026 06:51:09 -0500 Subject: [PATCH] [LORA] Fix buffer overflow when converting binary packets to hex (#2402) TheengsUtils::_rawToHex() formats each byte with "%02X\r", so the last sprintf writes two bytes past the 2 * size hex digits (the '\r' and the terminating null). LORAtoX() sized its buffer 2 * packetSize + 1, one byte short, overflowing the stack for every binary LoRa packet. Co-authored-by: Claude Opus 5.5 --- main/gatewayLORA.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main/gatewayLORA.cpp b/main/gatewayLORA.cpp index d389fa0..7915aa4 100644 --- a/main/gatewayLORA.cpp +++ b/main/gatewayLORA.cpp @@ -459,7 +459,7 @@ void LORAtoX() { return; } // We have non-ascii data: create hex string of the data - char hex[packetSize * 2 + 1]; + char hex[packetSize * 2 + 2]; // _rawToHex writes "%02X\r" per byte: needs 2 * size + 2 TheengsUtils::_rawToHex(packet, hex, packetSize); // Terminate with a null character hex[packetSize * 2] = 0;