Mirrors_Framework/ardupilot
1
0
Fork 0
mirror of https://github.com/ArduPilot/ardupilot.git synced 2026-10-02 10:23:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

AP_Baro: fix MS5837-02BA temperature integer overflow
pre-commit / ci (push) Canceled after 0s
test Renode / cubeorangeplus-quadplane (push) Canceled after 0s
test scripts / build (astyle-cleanliness) (push) Canceled after 0s
test scripts / build (check_autotest_options) (push) Canceled after 0s
test scripts / build (logger_metadata) (push) Canceled after 0s
test scripts / build (param-file-validation) (push) Canceled after 0s
test scripts / build (param_parse) (push) Canceled after 0s
test scripts / build (python-cleanliness) (push) Canceled after 0s
test scripts / build (shellcheck) (push) Canceled after 0s
test scripts / build (validate_board_list) (push) Canceled after 0s

Browse Source 
In AP_Baro_MS5837::_calculate_5837_02ba, the multiplication (dT * _cal_reg.c6) overflows a signed 32-bit integer when dT is positive (~250,000 at ~25-30 degC) and c6 is ~28,000, exceeding INT32_MAX (~7e9 vs 2.14e9). This resulted in truncated/invalid temperature readings (e.g. ~19 degC).

Cast dT to int64_t before multiplication to prevent overflow.
This commit is contained in:
PhipsmonET
2026-09-24 13:57:00 +10:00
committed by Peter Barker
parent 06e7f4ec6d
commit ee0c343fa1
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libraries/AP_Baro/AP_Baro_MS5611.cpp
+1 -1
View File
@@ -526,7 +526,7 @@ void AP_Baro_MS5837::_calculate_5837_30ba()
// Calculate Temperature and compensated Pressure in real units (Celsius degrees*100, mbar*100).
void AP_Baro_MS5837::_calculate_5837_02ba() {
int32_t dT = _D2 - ((int32_t)_cal_reg.c5 << 8);
int32_t TEMP = 2000 + ((dT * _cal_reg.c6) >> 23);
int32_t TEMP = 2000 + (((int64_t)dT * _cal_reg.c6) >> 23);
int64_t OFF = ((int64_t)_cal_reg.c2 << 17) + (((int64_t)_cal_reg.c4 * dT) >> 6);
int64_t SENS = ((int64_t)_cal_reg.c1 << 16) + (((int64_t)_cal_reg.c3 * dT) >> 7);