osd: fix one byte out-of-bounds write when drawing HUD POIs

[Raffi1202]

Problem

No issue was filed. The defect was found by reading the code while writing the OSD HUD documentation page (iNavFlight/iNavFlight.github.io#24). Whenever a radar POI (ESP32 craft radar peer) is drawn on the HUD, osdHudDrawPoi() writes one byte past the end of its local buff array, on every OSD frame that shows the marker. No visible symptom is known; the byte lands on adjacent stack memory.

Cause

src/main/io/osd_hud.c:130 on maintenance-10.x declares char buff[4], but both poiType == 1 (radar POI) paths write a terminator at index 4. osd_hud.c:250 tfp_sprintf(buff+1, "%3d", altc) puts three digits in buff[1..3] and '\0' in buff[4]. osd_hud.c:264, :273 and :286 call osdFormatCentiNumber(buff, ..., 4, 4, false), whose first statement is buff[length] = '\0' (src/main/io/osd_utils.c:50) with length = 4. The non-radar branches use width 3 and stay in bounds. All four characters buff[0..3] are read back at osd_hud.c:295-299, so the format cannot be shortened. The same lines are present at the same line numbers on release/9.1.

Change

Enlarges buff from 4 to 5 bytes in osdHudDrawPoi() and adds a comment naming the two writers of index 4. No control-flow or output change.

Test

Not run on hardware or SITL. Cause verified by reading src/main/io/osd_hud.c:130,250,264,273,286 and src/main/io/osd_utils.c:50 on maintenance-10.x. The upstream "Build firmware" run for the head commit is waiting for maintainer approval (https://github.com/iNavFlight/inav/actions/runs/34533380329); no fork build exists for the head SHA. Qodo review: no issues found.

Flash / RAM

Not measured yet. The upstream firmware CI has not been released for this PR, so no size report exists.

Docs

No documentation change needed: the displayed characters are unchanged; the fix only removes an out-of-bounds write.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Prevent HUD radar POI buffer overflow

🐞 Bug fix 🕐 Less than 5 minutes

AI Description

• Expands the HUD POI formatting buffer to include the required null terminator.
• Prevents one-byte stack writes beyond the buffer when rendering radar markers.

High-Level Assessment

Increasing the buffer from four to five bytes is the optimal fix. Shortening the formatted output would discard a displayed character, while changing shared formatting functions would unnecessarily broaden the change.

Files changed (1) +1 / -1

Bug fix (1) +1 / -1

osd_hud.cAllocate space for the radar POI string terminator +1/-1

Allocate space for the radar POI string terminator

• Expands the local formatting buffer from four to five bytes. This accommodates four displayed characters plus the null terminator written by both 'tfp_sprintf' and 'osdFormatCentiNumber'.

src/main/io/osd_hud.c

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗