Fixing a potential array bounds violation in ESPDMX

softhack007 · blazoncek · commit 21173dc907e8 · 2024-02-17T13:05:04.000+01:00
DMXESPSerial::write and DMXESPSerial::read could access DMXDataStore[512] -   one more than the allocated number of elements (i.e. 0...511].
diff --git a/wled00/src/dependencies/dmx/ESPDMX.cpp b/wled00/src/dependencies/dmx/ESPDMX.cpp
@@ -30,8 +30,8 @@
 bool dmxStarted = false;
 int sendPin = 2;		//default on ESP8266
 
-//DMX value array and size. Entry 0 will hold startbyte
-uint8_t dmxDataStore[dmxMaxChannel] = {};
+//DMX value array and size. Entry 0 will hold startbyte, so we need 512+1 elements
+uint8_t dmxDataStore[dmxMaxChannel+1] = {};
 int channelSize;
 
 
@@ -106,4 +106,4 @@ void DMXESPSerial::update() {
 
 // Function to update the DMX bus
 
-#endif
+#endif
