unpack_settings() for the v2.1 extended response frame copied
num_power_levels+1 bytes into the fixed power_levels[8] array, where
num_power_levels comes straight from the wire and is unbounded. A
malformed frame could request a copy of up to 256 bytes, overrunning
both the source and destination arrays.
Clamp the count to the size of the arrays before copying.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
parse_response_buffer() cast the received buffer to the response frame
struct selected by the command byte without checking that enough bytes
were actually received. A short or corrupt frame (for example a
GET_SETTINGS response with a length field of zero) could pass the CRC
check yet cause the parser to read channel/power/frequency fields from
buffer positions that were never written this cycle, pushing stale
values into the VTX settings.
Pass the received byte count into parse_response_buffer() and, in each
command case, reject frames that are too short for the struct being
interpreted.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
correct settings when power set is received
add support for capturing all supported power levels
learn power levels in SmartAudio 2.1
add better support for VTX power levels
don't set power to 0 if in pitmode
add option for iNav compatibility
support non-conforming SmartAudio implementations
re-enable pitmode on SmartAudio 2.0
add support for "blind" VTX setting
set the VTX parameters to what was actually configured by the VTX
use change band/change frequency when appropriate
set power levels appropriately for protocol version.
Co-authored-by: luis.martinez.exts <luis.martinez@juntadeandalucia.es>
Peter BarkerandClaude Opus 4.8
Andy Piper
VMsunghwan
Mingchen Zhang
giacomo892
