From 9df074db0768003845dadbdd0ae82a84b2f7341e Mon Sep 17 00:00:00 2001 From: Raphael Hunziker Date: Thu, 10 Sep 2026 23:38:50 +0200 Subject: [PATCH] osd: fix one byte out-of-bounds write when drawing HUD POIs osdHudDrawPoi() formats into char buff[4], but both of the poiType == 1 paths write a terminator at index 4: tfp_sprintf(buff + 1, "%3d", altc) writes three digits into buff[1..3] and the terminator into buff[4], and osdFormatCentiNumber(buff, ..., 4, 4, false) starts with buff[length] = '\0' with length 4, so it writes buff[4] directly. poiType == 1 is the radar POI, so this happens for every radar marker drawn, on every OSD frame that has one on screen. Both other branches use a width of 3 and stay inside the array. The four characters are all read back (buff[0..3] are written to the display for poiType == 1), so the array needs five bytes, not four. --- src/main/io/osd_hud.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/io/osd_hud.c b/src/main/io/osd_hud.c index 575a7a79d15..a73a8aa7690 100644 --- a/src/main/io/osd_hud.c +++ b/src/main/io/osd_hud.c @@ -127,7 +127,7 @@ void osdHudDrawPoi(uint32_t poiDistance, int16_t poiDirection, int32_t poiAltitu uint8_t center_x; uint8_t center_y; bool poi_is_oos = 0; - char buff[4]; + char buff[5]; // 4 characters plus the terminator osdFormatCentiNumber and tfp_sprintf write at index 4 int altc = 0; uint8_t minX = osdConfig()->hud_margin_h + 2;