51125 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
小小小朋友	3765a67639	fix(parameters): preserve EKF2_ENGINE_WRM on import (#28722) ... The old boolean is serialized as BSON_INT32, but the migration reads the double member and can disable an enabled setting. Rename the node and use the normal parameter import path. Validation: four focused host checks cover enabled/disabled values, a mismatched BSON type, and an unrelated parameter. Assisted-by: Codex Signed-off-by: onelittlechildawa <onelittlechild@outlook.com>	2026-09-21 20:06:24 -06:00
PX4BuildBot	59b6adfd09	docs: auto-sync metadata [skip ci] ... Co-Authored-By: PX4 BuildBot <bot@px4.io>	2026-09-22 01:18:07 +00:00
Qutibah Ananzeh	39d191cab6	fix(gps): correct GPS_UBX_CFG_INTF bitmask max to 63 (#28716) ... GPS_UBX_CFG_INTF declares six bits (0-5), so its range is 0-63, but it declares max: 32. 32 is the value of the highest bit on its own (I2C_OUT_PROT_RTCM3X = 1 << 5), not the all-bits-set value, so every value from 33 to 63 is published to ground stations as out of range. The smallest of them is UBX input plus RTCM3X output on I2C, 1 + 32. The parameter was introduced in df441ac202 with all six bits and max: 32 in the same hunk, so the mask never outgrew its maximum. GPS_1_GNSS and GPS_2_GNSS in the same file are also six-bit masks and both declare max: 63. They were corrected from 31 to 63 in c90ccabbe0 when NAVIC was added as their sixth bit, which is the same arithmetic. Tools/module_config/generate_params.py derives (1 << (max_bit + 1)) - 1 for a bitmask with no explicit max, which is 63 here. The metadata check in srcparser.py validates each bit on its own, int(min) <= 2**index <= int(max), so 2**5 = 32 <= 32 passes by exactly one and the inconsistency was never flagged. This is ground-station metadata only: min and max are not compiled into the firmware, so runtime behaviour is unchanged. Assisted-by: Claude:claude-opus-5 Signed-off-by: Qutibah Ananzeh <38795261+Ti-03@users.noreply.github.com>	2026-09-21 19:11:42 -06:00
Jacob Dahl	fbfc1386ee	ci(macos): install from pinned Homebrew commits ... The job ran brew update and then installed whatever Homebrew was publishing, except Gazebo, which stayed on one commit. Those were built against different protobufs, so a release upstream failed the build with no commit here. Check the package repos out at commits recorded in the tree and do not update them. Run on macos-15 only, so the OS label cannot move either. Assisted-by: Grok:grok-4.7 Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>	2026-09-21 16:55:31 -07:00
Jacob Dahl	49339b843f	ci(macos): remove the MacOS workflows ... The build runs brew update and then pours Gazebo from one pinned tap commit while the rest of the install, including protobuf, comes from current Homebrew. A release in either repo fails the check with no commit here, and the GitHub-hosted image moves on its own, so the job cannot be a closed set. Drop the build and the weekly pin refresh. The setup script, the pins, and the refresh script stay for local use. Assisted-by: Grok:grok-4.7 Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>	2026-09-21 16:55:31 -07:00
Jacob Dahl	db99f32cf2	ci(macos): disable the MacOS build check ... make px4_sitl fails when Homebrew's protobuf is not the one the pinned Gazebo bottles were generated against. Those generated headers are a fatal error against any other version, and that has been failing these legs since 2026-09-02. Take the check off push and pull requests. workflow_dispatch still runs it. Assisted-by: Grok:grok-4.7 Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>	2026-09-21 16:55:31 -07:00
PX4 Build BotandCrowdin Bot	1b6a636520	docs(i18n): PX4 guide translations (Crowdin) - zh-CN (#28767) ... Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-09-22 08:45:21 +10:00
PX4 Build BotandCrowdin Bot	dbc3998ea7	docs(i18n): PX4 guide translations (Crowdin) - uk (#28766) ... Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-09-22 08:45:02 +10:00
Balduin	1fe68ea764	fix(mavlink): follow backward compatibility guidelines (#28740) ... * fix(ekf2): tag EKF2_MAG_TYPE STATUSTEXT for event dedup Missing trailing tab meant a modern GCS wouldn't suppress this legacy STATUSTEXT in favor of the paired event, showing the message twice. Signed-off-by: Balduin <balduin@auterion.com> * fix(navigator): tag in-air landing STATUSTEXT for event dedup Missing trailing tab meant a modern GCS wouldn't suppress this legacy STATUSTEXT in favor of the paired feasibility_mis_in_air_landing_req event, showing the message twice. Signed-off-by: Balduin <balduin@auterion.com> * fix(mavlink): stop dropping the CAN/camera ID collision warning This STATUSTEXT was tagged for event-dedup suppression but has no paired event, so a modern GCS silently discarded it instead of showing it. Signed-off-by: Balduin <balduin@auterion.com> --------- Signed-off-by: Balduin <balduin@auterion.com>	2026-09-21 16:37:56 -06:00
Claudio Chies	29ac50fd63	fix(sensor_gps_sim): implement RTCM correction handling for improved GPS fix accuracy (#28741)	2026-09-21 16:35:18 -06:00
Julian Oes	9c19256851	fix(mavlink): reset mission index on a completed upload (#28775) ... A completed mission upload only updated the active mission when the uploaded mission differed from the stored one: // Only need to update if the mission actually changed if (_transfer_current_crc32 != _crc32[MAV_MISSION_TYPE_MISSION]) { update_active_mission(...); } update_active_mission() is what resets the current index and tells the navigator about it, so re-uploading an identical mission left the index wherever it was. After a reboot that index is restored from the mission state in dataman, which is the last item of the previous flight, and the mission then reports itself finished a few milliseconds after being started: INFO [navigator] Executing Mission INFO [navigator] Mission finished, landed WARN [navigator] No valid mission available, refusing takeoff An upload means the mission is to be flown from the start, so update the active mission on every completed upload.	2026-09-21 16:25:16 -06:00
Anil Kircaliali	b5a7649062	fix(boards): remove local_position_estimator from corvon to free flash (#28728)	2026-09-22 10:18:53 +12:00
Vincello	e39f34ce60	fix(boards/corvon_v5): replace stale Kconfig symbols (#28755) ... The default build omits fixed-wing position control. Use the current symbols and drop the obsolete ones. Signed-off-by: holydust <holydust@live.ca>	2026-09-22 10:18:00 +12:00
Holybro-zebulon-86	5a09e55fbc	feat(boards): add LSM6DSV support for Kakute H7 Wing (#28780) ... * feat(boards): add LSM6DSV support for Kakute H7 Wing * fix(boards): lower Kakute H7 Wing OSD work queue priority Run SPI2 below the SPI3 IMU queue to reduce delays caused by ATXXXX updates.	2026-09-22 10:16:11 +12:00
Julian Oes	1d7b23e198	build(macos): pin protobuf to what the gz bottles need (#28774) ... Every gz .pb.h refuses to compile against anything but the exact protobuf its gencode came from, so the bottles gz-tap-pin.txt holds osrf/simulation at only build against the protobuf homebrew-core shipped the day OSRF built them. homebrew-core moves protobuf on its own schedule and OSRF rebuilds days later, so `make px4_sitl` has been failing on macOS on every branch since homebrew-core shipped protobuf 36.2. Pin protobuf as well, to the homebrew-core revision that installs the version the pinned gz bottles carry, and derive that pin from the bottles themselves so the two can never disagree. A protobuf release then becomes a no-op here instead of days of red CI while OSRF catches up. The pinned install has to run after the other simulation packages and with the dependents check off: opencv@4 depends on protobuf too, brew resolves a dependency against the versions recorded in the dependent's bottle, and it reinstalls dependents whose linkage it has just broken. Pinning the formula with `brew pin` is not an option either, brew then refuses to install anything that depends on it. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-22 10:15:13 +12:00
Julian Oes	6c4cc3a8a5	fix(airbrainh743): re-enable the W25N NAND flash driver (#28675) ... The NuttX 12.12.0 defconfig refresh dropped CONFIG_MTD_W25N and CONFIG_W25N_SPIFREQUENCY from this board while the other W25N boards (kakuteh7mini, kakuteh7v2) kept them. The option still exists in NuttX 12.12 and defaults to off, and the board's init.c only registers the flash under #ifdef CONFIG_MTD_W25N, so the onboard 128 MB NAND was no longer initialised: no /fs/flash, no logging, no flash-backed dataman. Restore both options with the 104 MHz SPI frequency the board used before. Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-22 10:14:28 +12:00
Julian Oes	c8a6cc3656	fix(tinybson): reject a negative document length (#28607) ... The BSON document length is the first four bytes of the document and is signed. bson_decoder_init_buf() checked it against the buffer size, but the check only ran when the value was positive, so a negative length skipped it and decoding proceeded with no bound. bson_decoder_init_file() did not check the length at all. Reject a negative length in both, and add a regression test, since the existing BSON test only covers a round trip of data it encoded itself. Reported by @lihnucs. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-22 10:14:08 +12:00
Julian Oes	4547119094	fix(mavlink): terminate the published gimbal name strings (#28605) ... GIMBAL_DEVICE_INFORMATION carries three 32-byte name fields. The handler copies each into the uORB message and then writes the terminator into gimbal_device_info_msg, the decoded MAVLink struct it is about to discard, rather than into the topic it publishes. The copies are the same size in both directions, so nothing overflows. What publishes is a field that can hold 32 bytes with no terminator, which any consumer reading it as a string would run off. No consumer does today, so this changes no behaviour. It is wrong as written and the next reader of those fields would inherit it. Reported by @lihnucs. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-22 10:13:39 +12:00
Beniamino Pozzan	1459066534	docs(containers): add mention to ghcr.io/px4/px4-dev-ros2-gazebo ... Signed-off-by: Beniamino Pozzan <beniamino.pozzan@gmail.com>	2026-09-21 11:18:58 -07:00
Beniamino Pozzan	403b957e77	ci(ros_dev): add ros2-gazebo-dev target to ros_dev_container.yml ... Signed-off-by: Beniamino Pozzan <beniamino.pozzan@gmail.com>	2026-09-21 11:18:58 -07:00
Beniamino Pozzan	cc09df637f	feat(containers): add development container with ROS 2 and Gazebo ... Signed-off-by: Beniamino Pozzan <beniamino.pozzan@gmail.com>	2026-09-21 11:18:58 -07:00
Beniamino Pozzan	9300113ada	fix(docker): mark all repo as safe for git when running in container ... whitelisting only PX4 source directory made git commands fail when executed on the submodules Signed-off-by: Beniamino Pozzan <beniamino.pozzan@gmail.com>	2026-09-21 11:17:46 -07:00
Julian Oes	2fc441493e	ci(commit_checks): pass the PR title through the environment (#28772) ... The PR title was interpolated directly into the shell command, so bash parsed it as syntax before argparse ever saw it. A title containing double quotes split into several arguments and failed the check for the wrong reason, and a hostile title could run arbitrary commands on the runner. Pass it via the environment like the labeler workflow already does, so it is data rather than syntax. Also make sure a report exists when the check fails without writing one, otherwise the posting step dies on a missing comment.md and hides the actual error. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-21 11:15:57 +12:00
PX4BuildBot	d4ec8a10f1	docs: auto-sync metadata [skip ci] ... Co-Authored-By: PX4 BuildBot <bot@px4.io>	2026-09-20 22:54:36 +00:00
3 people	f5586139e4	feat(security): define security scope (#28571) ... * docs(mavlink): present link encryption alongside message signing The hardening guide told integrators that production deployments must enable message signing, presenting it as the only way to secure a MAVLink link. Encrypting the link below MAVLink, with an encrypted radio, a VPN or IPsec, is at least as strong: it uses standard, reviewed cryptography, it gives confidentiality as well as authentication, and it covers every interface on the link rather than only MAVLink. Present both options, and reword the passages that assumed signing was the only one. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch> * docs(security): develop security fixes in public pull requests Record that fixes are developed as ordinary public pull requests, with no private forks and no embargoed branches. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch> * docs(security): add security scope document Describe the boundary the code implements today: what PX4 protects, what it assumes about the layers beneath it, what the shipped default does and does not do, and two lists for what is always in scope and what is out. It describes the boundary rather than pre-deciding reports. A finding that fits neither list stays a judgement call that maintainers make on the report. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch> * docs(security): list a security maintainer for report triage Security report triage had no named owner, so an unacknowledged report had nowhere to go except the release managers. Add a Security block to the maintainers list, and point the follow-up path in SECURITY.md at it. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch> * docs(mavlink): note that the first signing key is unauthenticated The guide already says to provision over a trusted link, and the info box says that changing or disabling a key requires a signed message. It does not say that setting the first one cannot, since there is no key to sign with yet, so a reader can come away believing provisioning itself is protected. Say plainly that the window exists, what an attacker gets from it, and how to recover. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch> * Apply batched suggestions from code review Co-authored-by: Sheren N <sherenyn@ad.uni-paderborn.de> Co-authored-by: Hamish Willee <hamishwillee@gmail.com> Co-authored-by: Julian Oes <julian@oes.ch> * feat(security): more review fixup * fix(security): only 1.18 gets security bugfixes * fix(security): link to SECURITY_SCOPE * fix(securiy): small wording fixups * docs(security): scope by attacker position, not bug class The "Always in scope" list made any memory corruption, race or hang a vulnerability regardless of who can reach it. That is not how reports have been handled: sanitizer runs in SITL have found and fixed many such bugs as ordinary PRs, and a peer on an unsecured link already has a shell. Replace it with one test: a finding is a vulnerability when it gives capability to an attacker who has neither the operator's access nor physical access. Keep the in-tree board configuration rule, point to the sanitizer docs, and fix two typos. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch> * fix(docs): formatting * fix(maintainers): add Ramon to security as well * docs(security): draw the boundary as a mermaid diagram GitHub renders mermaid natively, so the boundary diagram no longer has to be maintained as hand-aligned ASCII. Label the two zones with the wording of the sentences below it, so the picture and the prose say the same thing. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch> * fix(docs): review fixups * docs(security): say how to isolate the offboard transports A direct cable between flight controller and companion is not enough on its own: the agent or router republishes into the DDS or Zenoh network on the companion, so that network is inside the boundary too. Keep the scope document to what is inside the boundary and put the isolation advice next to the uXRCE-DDS and Zenoh setup instructions. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch> --------- Signed-off-by: Julian Oes <julian@oes.ch> Co-authored-by: Sheren N <sherenyn@ad.uni-paderborn.de> Co-authored-by: Hamish Willee <hamishwillee@gmail.com>	2026-09-21 10:49:01 +12:00
Julian Oes	b637daa4cf	fix(mavlink): send tabbed size and mtime for directories in ListDirectoryWithTime (#28628) ... The ListDirectoryWithTime (opcode 16) entry format is <type><name>\t<size>\t<mtime>\0, but PX4 only applied it to files and sent directories as a bare D<name>. MAVSDK's server already sends D<name>\t0\t<mtime>, so the two servers disagreed and a client had to special-case which one it was talking to. Directories are now stat()ed for their modification time and reported with size 0, matching MAVSDK. The plain ListDirectory (opcode 3) response is unchanged: existing clients take everything after the D as the directory name there. Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-21 10:04:11 +12:00
YG_Kim	afef6a450f	build(nuttx): update Ethernet carrier status reporting ... Include PX4/NuttX#418 so the IMXRT and STM32 Ethernet drivers report IFF_RUNNING through netdev_carrier_on/off(). The Zenoh startup check relies on these interface flags. Assisted-by: Codex:gpt-6-astra Signed-off-by: YG_Kim <yeogyeom1@naver.com>	2026-09-20 11:34:58 -04:00
YG_Kim	82d49a0392	fix(zenoh): wait for interface readiness before opening a session ... Zenoh can enter a blocking session open before its NuttX network interface has finished starting. Check interface readiness once at startup, with a bounded wait that honors stop requests, while keeping the existing session retry loop. Initialize the session handle for safe early cleanup and retain atomic connection status. Have getNetworkConfig() initialize and terminate its output strings so both callers receive valid C strings. Assisted-by: Claude:claude-fable-5-1 Assisted-by: Codex:gpt-6-astra Signed-off-by: YG_Kim <yeogyeom1@naver.com>	2026-09-20 11:34:58 -04:00
Daniel Buleandră	c4e4ef98e9	fix(uxrce_dds_client): Separate topic creation from request data (#28641) ... Address review feedback on the split between entity creation and data requests: - Reuse data_reader_id() in dds_topics.h.em instead of duplicating the ID formula in the on_topic_update() switch cases. - Drop the now-unused best_effort_in_stream_id parameter from SendTopicsSubs::init() and RcvTopicsPubs::init(). - Handle UXR_INVALID_REQUEST_ID in RcvTopicsPubs::request_data(): the reliable output stream has only STREAM_HISTORY slots, and a slot is freed only by an Agent ACKNACK, not by uxr_flash_output_streams(). On overflow, wait for delivery to be confirmed (which drains acknowledged slots) and retry once before giving up. Verified on hardware by shrinking the reliable stream's slot size to force the overflow path: recovery completes in ~2.5ms per occurrence and the session still connects. With the stock buffer size and the current topic count (38 readers, ~760B of requests against 2016B of capacity), the overflow path is not exercised in practice. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: danielbuleandra <daniel.buleandra@auterion.com>	2026-09-18 13:06:04 +02:00
Jonas Perolini	e9e11c507c	fix(navigator): parse polygons correctly after geofence circles (#28745)	2026-09-18 07:32:10 +02:00
Marco Hauswirth	1cfd3f8895	fix(ekf2): prevent emergency yaw reset to unconverged EKF-GSF after in-flight GNSS re-enabling	2026-09-17 14:42:13 +02:00
SaibernardandHamish Willee	fe87271f9c	docs(releases): add v1.18 notes for five backported fixes (#28547) ... * docs(releases): add v1.18 notes for five backported fixes The estimator selector, VTOL mission return, analog battery filter, home altitude filter and mission end fixes are on release/1.18 now, this adds their entries to the release notes. Assisted-by: Claude:claude-fable-5 Signed-off-by: Saibernard Yogendran <bernie97@seas.upenn.edu> * MOve entries * docs(releases): add the v1.18 note for the position controller filter fix #28534 merged onto release/1.18 after the first five entries. Assisted-by: Claude:claude-fable-5 Signed-off-by: Saibernard Yogendran <bernie97@seas.upenn.edu> --------- Signed-off-by: Saibernard Yogendran <bernie97@seas.upenn.edu> Co-authored-by: Hamish Willee <hamishwillee@gmail.com>	2026-09-17 12:35:49 +10:00
PX4BuildBot	3de9e4d2d3	docs: auto-sync metadata [skip ci] ... Co-Authored-By: PX4 BuildBot <bot@px4.io>	2026-09-16 22:11:14 +00:00
Julian Oesandjonas	75cb93a7e7	fix(navigator): report a failed geofence load instead of leaving a fragment (#28603) ... * fix(navigator): report a failed geofence load instead of leaving a fragment _updateFence() resets _num_polygons and rebuilds the fence from dataman one polygon at a time. It can stop early two ways: loadWait() failing for an entry, or the array resize failing to allocate. Both logged to the console and left whatever had been loaded so far in place. A fragment of a fence is worse than no fence. Missing inclusion polygons permit positions the fence excluded, missing exclusion polygons open up areas it protected, and unlike an empty fence it still looks to the operator like a fence is loaded. Drop what was loaded on either failure and report it with mavlink_log_critical and an event, so the state is unambiguous and the operator is told the fence is not active rather than finding out in flight. Reported by @lihnucs, who found the allocation path. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch> * rework(navigator): use _clearFence in ~Geofence() * refactor(navigator): move new functions in hpp * fix(navigator): pub GF_STATUS_FAILED when _updateFence fails and ensure GF is reloaded if previously failed with new request with same opaque id * refactor(navigator): remove redundant check * feat(msg): add GF_STATUS_FAILED to GeofenceStatus.msg * refactor(navigator): rename _fence_updated to _fence_loaded The flag now means the requested fence was loaded successfully, and "updated" reads like a uORB or dataman change. Default it to false since nothing is loaded at boot. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julian Oes <julian@oes.ch> --------- Signed-off-by: Julian Oes <julian@oes.ch> Co-authored-by: jonas <jonas.perolini@rigi.tech>	2026-09-17 10:04:40 +12:00
jmackay2andjmackay2	fd1ddbc22e	fix(simulation): remove unnecessary double-float conversion (#28715) ... Co-authored-by: jmackay2 <jmackay2@gmail.com>	2026-09-16 18:10:24 +01:00
PX4BuildBot	d1862ac96b	docs: auto-sync metadata [skip ci] ... Co-Authored-By: PX4 BuildBot <bot@px4.io>	2026-09-16 16:00:00 +00:00
Balduin	571a20a15a	fix(msg): correct comments/docs regarding default values (#28729) ... * fix(msg): correct comments regarding default values The mentioned defaulting happens in FwLateralLongitudinalControl::updateLongitudinalControlConfiguration, where they clearly default to the climb / sink rate _setpoint_, not the respective maximum. No new message version needed as only comment is changed. * fix(msg): correct stale publisher reference in FixedWingLateralGuidanceStatus fw_pos_control was split into fw_mode_manager and fw_lateral_longitudinal_control; the topic is published by the mode manager.	2026-09-16 17:53:40 +02:00
Claudio ChiesandClaudio Chies	651b8687b8	feat(failure_injection): selectable detected/un-detected motor failure via SYS_FAIL_MOT_OFF (#28210) ... * feat(failure-injection): implement motor failure injection with soft and hard modes * feat(failure-injection): update motor failure injection descriptions and behaviors for annunciated and un-annunciated modes * feat(failure-injection): update motor failure injection terminology to detected and undetected modes * feat(failure-injection): refine motor failure injection handling for detected and undetected modes * fix(boards): remove FailureInjector::update() from itcm_functions FailureInjector was replaced by the shared failure_injection library, so the symbol no longer exists and the ITCM check fails on the boards that still list it. Its successor failure_injection::Config::update() is an inline no-op unless MODULES_FAILURE_INJECTION_MANAGER is enabled, which none of these boards do, so there is no replacement symbol to map. Assisted-by: Claude:claude-opus-5 Signed-off-by: Claudio-Chies <61051109+Claudio-Chies@users.noreply.github.com> --------- Signed-off-by: Claudio-Chies <61051109+Claudio-Chies@users.noreply.github.com> Co-authored-by: Claudio Chies <chiesc@chies.com>	2026-09-16 10:10:18 +02:00
PX4 Build BotandCrowdin Bot	dd505dc4d4	docs(i18n): PX4 guide translations (Crowdin) - uk (#28686) ... Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-09-16 15:23:17 +10:00
PX4 Build BotandCrowdin Bot	479639f9db	docs(i18n): PX4 guide translations (Crowdin) - ko (#28685) ... Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-09-16 15:22:55 +10:00
PX4 Build BotandCrowdin Bot	4a5a2f027d	docs(i18n): PX4 guide translations (Crowdin) - zh-CN (#28687) ... Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-09-16 15:22:36 +10:00
Julian Oes	2028113139	fix(mavlink): bound the FTP directory listing error path (#28602) ... The entry loop checks it has room before appending, but the readdir() error path does not: it writes the skip identifier and a terminator unconditionally. If the buffer already holds exactly kMaxDataLength bytes of valid entries when readdir() fails with errno set, those two bytes land past payload->data[]. payload->size then exceeds kMaxDataLength, and _reply() computes kMaxDataLength - payload->size as the length for a memset. That subtraction is performed on promoted ints and converted to size_t, so -2 becomes SIZE_MAX - 1 and the memset walks off across the address space. Apply the same room check the entry loop uses, and clamp payload->size in _reply() so no future producer can wrap that subtraction either. Reported by @lihnucs. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-16 12:01:36 +12:00
Julian Oes	3acf7935a0	fix(drivers/ft_technologies): bound the FT7 wind sensor parser buffers (#28600) ... The parser indexes every one of its buffers with a counter that resets only on a delimiter or end of line, so a sensor that sends neither writes past the end of each of them. _readbuf is 30 bytes indexed by _byte_counter, which resets on '\n'. The four field buffers, _raw_speed[5], _raw_angle[5], _raw_status[2] and _raw_checksum[3], are indexed by _msg_byte_counter, which resets on ',', '=', '*', '$' or '\r'. A response such as "$A,WVP=" followed by a long run of digits walks off the speed buffer and into whatever follows it. Bound each write. The field buffers keep their last byte clear, since the atoi() calls rely on the terminator the reset memset leaves behind. Those memsets also cleared _readbuf using sizeof(_linebuf), a different and smaller array, so ten bytes of the previous message survived into the next and fed the checksum. Use the right size. Reported by @kmm2003. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-16 11:02:40 +12:00
Julian Oes	0c903d47d6	fix(drivers/iridiumsbd): bound the TX buffer write against the bytes copied (#28599) ... write() checked for space using _packet_length, the declared size of the message being assembled, while the memcpy copies buflen. _packet_length decrements across calls as a message is written in chunks, so it can be small while buflen is large, and the check then passes for a copy that does not fit. A 300-byte write followed by a 10-byte MAVLink v2 header leaves the write index at 310 and _packet_length at 6, so a following 50-byte write passes the check and copies twenty bytes past the end of the 340-byte buffer. Check the space against both the remaining packet and the bytes this call copies. _packet_length -= buflen also wrapped, since _packet_length is a uint16_t and buflen can exceed it whenever the declared length and the bytes actually written disagree. The value then never reached zero and the packet-assembly state stayed set. Saturate at zero instead. Reported by @Finder16 and @Lqs66. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-16 11:02:04 +12:00
Julian Oes	ae63ebc726	fix(mavlink): only handle log requests addressed to this vehicle (#28585) ... LOG_REQUEST_LIST, LOG_REQUEST_DATA, LOG_REQUEST_END and LOG_ERASE all carry target_system and target_component, and MavlinkLogHandler ignored both. The message is not even decoded in handle_log_erase(): every LOG_ERASE seen on the link deletes this vehicle's logs, whoever it was addressed to. On a link shared with more than one vehicle, which is the normal case for a ground station managing several or for a swarm, erasing one vehicle's logs erases them everywhere, and a listing or download request for one vehicle is answered by all of them, corrupting the transfers. Check the target in each handler, next to the decode it already performs. Only handle_log_request_end() and handle_log_erase() gain a decode, because they had none. Reported by @20210607 and @Nathaniel-hl. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-16 11:01:40 +12:00
Julian Oes	dd3273ac3b	fix(drivers/sagetech_mxs): reject SVR frames shorter than their field set (#28580) ... sgDecodeSVR() walks a running offset through optional fields, each present only when its flag bit is set, and never checks that the frame actually carried them. The receive buffer is a fixed 259-byte Packet, so a short frame does not read out of bounds, but it does decode leftover bytes from the previous message. The result is a traffic target published with a latitude, longitude, altitude and velocity assembled from stale data, which the navigator then treats as real traffic. Sum the payload the advertised field set requires and reject the frame if the advertised payload length is shorter. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-16 10:55:58 +12:00
Julian Oes	8be88f3497	fix(drivers/sagetech_mxs): copy fixed-width wire fields without strcpy (#28579) ... Both decoders treat a fixed-width, space-padded wire field as a NUL-terminated C string. In sgDecodeFlightId(), flightId is char[8] inside the packed wire struct, followed by rsvd[4] and checksum. strcpy() copies until it finds a zero byte, so a transponder that sends eight non-NUL characters and non-zero trailing bytes makes it run off the end of the local struct and into the stack, writing into a nine-byte destination the whole way. sgDecodeInstall() has the same bug with registration, char[7] copied into an eight-byte destination. Copy exactly the field width and terminate. The trailing memset was already writing the terminator in the right place; it just ran after the overflow. Both are reachable from the transponder serial link: a FlightID_Response or Installation_Response is decoded as soon as it arrives. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-16 10:55:45 +12:00
Julian Oes	88bb9f86e6	fix(drivers/msp_osd): bound the MSP receive buffer and the VTX table indices (#28578) ... Three out-of-bounds writes reachable from the MSP serial link, all driven by fields the connected device controls. MspV1::Receive() read payload_size + MSP_CRC_SIZE bytes into a caller-supplied buffer without knowing how big it was. payload_size is a uint8_t taken straight off the wire and the only caller passes a 255-byte stack buffer, so a frame advertising 255 bytes of payload wrote one attacker-chosen byte past the end. Pass the destination size and reject a frame that does not fit. The VTX table handlers indexed 1-based table entries with upper-bound-only checks. For MSP_SET_VTXTABLE_BAND, band 0 satisfies "band <= BAND_COUNT" and writes 29 bytes at vtx_bands[-1]. For MSP_SET_VTXTABLE_POWERLEVEL, packet[0] of 0 promotes to -1, which is less than POWER_LEVEL_COUNT, and writes at power_levels[-1]. Require the index to be at least 1. Neither handler checked the frame was long enough to contain the struct it casts the packet to, so also require that. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Julian Oes <julian@oes.ch>	2026-09-16 10:55:28 +12:00
alexcekay	f1c0a1f794	fix(v6s): Increase eth responsiveness during boot (updates NuttX)	2026-09-15 14:40:06 +02:00
bresch	d4ab2cff93	fix(ekf2): keep GNSS checks relaxed between arming and takeoff ... The strict GNSS quality checks were re-armed whenever the vehicle was not airborne, so a transient accuracy excursion after arming or during the takeoff transient could tear down GNSS aiding and force a blind land. Hold the latch while armed and only re-run the strict checks once parked. Assisted-by: Claude:claude-opus-5 Signed-off-by: bresch <brescianimathieu@gmail.com>	2026-09-15 14:32:15 +02:00