berkus
/
wifi-densepose
mirror of https://github.com/ruvnet/wifi-densepose.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

refactor(mmwave): use sizeof() in mr60_process_frame bounds checks (#414) 

Automated security fix generated by Orbis Security AI
This commit is contained in:
OrbisAI Security 2026-05-18 03:45:01 +05:30 committed by GitHub
parent 07086c5d9d
commit acbd3ff13c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
firmware/esp32-csi-node/main/mmwave_sensor.c
View File

@ -109,7 +109,7 @@ static void mr60_process_frame(uint16_t type, const uint8_t *data, uint16_t len)
switch (type) { switch (type) {
case MR60_TYPE_BREATHING: case MR60_TYPE_BREATHING:
if (len >= 4) { if (len >= sizeof(float)) {
/* Breathing rate as float32 (little-endian in payload). */ /* Breathing rate as float32 (little-endian in payload). */
float br; float br;
memcpy(&br, data, sizeof(float)); memcpy(&br, data, sizeof(float));
@ -120,7 +120,7 @@ static void mr60_process_frame(uint16_t type, const uint8_t *data, uint16_t len)
break; break;
case MR60_TYPE_HEARTRATE: case MR60_TYPE_HEARTRATE:
if (len >= 4) { if (len >= sizeof(float)) {
float hr; float hr;
memcpy(&hr, data, sizeof(float)); memcpy(&hr, data, sizeof(float));
if (hr >= 0.0f && hr <= 250.0f) { if (hr >= 0.0f && hr <= 250.0f) {
@ -130,13 +130,13 @@ static void mr60_process_frame(uint16_t type, const uint8_t *data, uint16_t len)
break; break;
case MR60_TYPE_DISTANCE: case MR60_TYPE_DISTANCE:
if (len >= 8) { if (len >= sizeof(uint32_t) + sizeof(float)) {
/* Bytes 0-3: range flag (uint32 LE). 0 = no valid distance. */ /* Bytes 0-3: range flag (uint32 LE). 0 = no valid distance. */
uint32_t range_flag; uint32_t range_flag;
memcpy(&range_flag, data, sizeof(uint32_t)); memcpy(&range_flag, data, sizeof(uint32_t));
if (range_flag != 0 && len >= 8) { if (range_flag != 0) {
float dist; float dist;
memcpy(&dist, &data[4], sizeof(float)); memcpy(&dist, &data[sizeof(uint32_t)], sizeof(float));
s_state.distance_cm = dist; s_state.distance_cm = dist;
} }
} }