From e1c1d76c5fd6943b26e65dc91545752480630bac Mon Sep 17 00:00:00 2001 From: nullrouten0 <201262769+nullrouten0@users.noreply.github.com> Date: Wed, 11 Nov 2026 17:58:36 +0000 Subject: [PATCH] GPS: stop MicroNMEA reading past the NMEA buffer Add a 16-byte zeroed tail behind the 100-byte NMEA buffer. MicroNMEA's fixed-width field skips can read a few bytes past the end of a malformed sentence; with the tail those reads land on NUL bytes. Co-Authored-By: Claude Sonnet 5.5 --- src/helpers/sensors/MicroNMEALocationProvider.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/helpers/sensors/MicroNMEALocationProvider.h b/src/helpers/sensors/MicroNMEALocationProvider.h index bc9f5efa76..09b4d95546 100644 --- a/src/helpers/sensors/MicroNMEALocationProvider.h +++ b/src/helpers/sensors/MicroNMEALocationProvider.h @@ -23,7 +23,12 @@ #endif class MicroNMEALocationProvider : public LocationProvider { - char _nmeaBuffer[100]; + // MicroNMEA never writes past the length it is given, but its fixed-width field + // skips can read a few bytes past the end of a malformed sentence. The zeroed tail + // lets those reads stop on NUL bytes instead of reading the members that follow. + static constexpr size_t NMEA_BUFFER_LEN = 100; + static constexpr size_t NMEA_BUFFER_TAIL = 16; + char _nmeaBuffer[NMEA_BUFFER_LEN + NMEA_BUFFER_TAIL] = {}; MicroNMEA nmea; mesh::RTCClock* _clock; NmeaGpsDriver* _driver; @@ -135,7 +140,7 @@ class MicroNMEALocationProvider : public LocationProvider { public: MicroNMEALocationProvider(NmeaGpsDriver& driver, mesh::RTCClock* clock = nullptr) - : nmea(_nmeaBuffer, sizeof(_nmeaBuffer)), _clock(clock), _driver(&driver) {} + : nmea(_nmeaBuffer, NMEA_BUFFER_LEN), _clock(clock), _driver(&driver) {} void begin() override { _begin_calls++;