Jan/WLED_MM_Infinity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix array overflow in exploding_fireworks

Browse Source 
Attempt to allocate enough room for the "minimum" sparks; and ensure
that we never overrun the allocated array size.

Fixes #4120
This commit is contained in:
Will Miles
2024-11-16 17:10:08 -05:00
committed by Frank
parent e4902b8c48
commit 3e44b7852e
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
wled00/FX.cpp
View File

@@ -3600,8 +3600,8 @@ uint16_t mode_exploding_fireworks(void)
if (segs <= (strip.getMaxSegments() /4)) maxData *= 2; //ESP8266: 1024 if <= 4 segs ESP32: 2560 if <= 8 segs if (segs <= (strip.getMaxSegments() /4)) maxData *= 2; //ESP8266: 1024 if <= 4 segs ESP32: 2560 if <= 8 segs
int maxSparks = maxData / sizeof(spark); //ESP8266: max. 21/42/85 sparks/seg, ESP32: max. 53/106/213 sparks/seg int maxSparks = maxData / sizeof(spark); //ESP8266: max. 21/42/85 sparks/seg, ESP32: max. 53/106/213 sparks/seg
uint16_t numSparks = min(2 + ((rows*cols) >> 1), maxSparks); unsigned numSparks = min(5 + ((rows*cols) >> 1), maxSparks);
uint16_t dataSize = sizeof(spark) * numSparks; unsigned dataSize = sizeof(spark) * numSparks;
if (!SEGENV.allocateData(dataSize + sizeof(float))) return mode_static(); //allocation failed if (!SEGENV.allocateData(dataSize + sizeof(float))) return mode_static(); //allocation failed
float *dying_gravity = reinterpret_cast<float*>(SEGENV.data + dataSize); float *dying_gravity = reinterpret_cast<float*>(SEGENV.data + dataSize);
@@ -3652,8 +3652,9 @@ uint16_t mode_exploding_fireworks(void)
* Explosion happens where the flare ended. * Explosion happens where the flare ended.
* Size is proportional to the height. * Size is proportional to the height.
*/ */
int nSparks = flare->pos + random8(4); unsigned nSparks = flare->pos + random8(4);
nSparks = constrain(nSparks, 4, numSparks); nSparks = std::max(nSparks, 4U); // This is not a standard constrain; numSparks is not guaranteed to be at least 4
nSparks = std::min(nSparks, numSparks);
// initialize sparks // initialize sparks
if (SEGENV.aux0 == 2) { if (SEGENV.aux0 == 2) {