Fix SetStatusDelimiter: stack over-read and pointer-sign warnings #1

movitz · 2026-10-28T14:38:15Z

movitz commented

2026-10-28 14:38:15 +00:00

Summary

Two fixes to YEEP144lib/src/YEEP144_BluetoothUART.c, against the 1.2 release.

Both are pre-existing issues that 1.2 does not address. 7 insertions, 3 deletions, one file.

Fix 1 — `SetStatusDelimiter()` over-reads a stack buffer

uint8_t rxBuf[10];
...
char txBuf[8] = {0};
sprintf(txBuf, "SO,,%c", '\r');
HAL_UART_Transmit(&huart2, txBuf, sizeof(rxBuf), UART_POLL_TIMEOUT);
                                    ^^^^^^^^^^^^ rxBuf is uint8_t[10]

rxBuf is a different, unrelated buffer declared earlier in the same function, so this transmits 10 bytes from an 8-byte array — a two-byte stack over-read, and two bytes of stack garbage follow every SO command the module receives.

Fixed by sending strlen(txBuf), which stops at the NUL that sprintf() wrote. sizeof(txBuf) would also stop the over-read but would still transmit the padding NULs.

Since 1.2 no longer calls this function from Init(), it is only reachable if an application calls it directly — but it is a public API function, and the over-read is undefined behaviour either way.

Fix 2 — three `-Wpointer-sign` warnings

HAL_UART_Transmit() takes const uint8_t *; the function passes char * at three sites. Casts added, and the file now compiles warning-free. These warnings sit on the same lines as Fix 1, which is part of why the over-read went unnoticed.

Not included — already fixed by 1.2

An earlier report covered BluetoothUART_Init() entering the module's command mode and rebooting the RN4678 on every boot. 1.2 removes that call from Init(), so nothing is needed here. A suggested follow-up is recorded in CODE_FIXES.md: expose the configuration as an explicit ConfigureModule() rather than as a side effect of startup.

Full write-up

CODE_FIXES.md

## Summary Two fixes to `YEEP144lib/src/YEEP144_BluetoothUART.c`, against the **1.2 release**. Both are pre-existing issues that 1.2 does not address. **7 insertions, 3 deletions, one file.** ## Fix 1 — `SetStatusDelimiter()` over-reads a stack buffer ```c uint8_t rxBuf[10]; ... char txBuf[8] = {0}; sprintf(txBuf, "SO,,%c", '\r'); HAL_UART_Transmit(&huart2, txBuf, sizeof(rxBuf), UART_POLL_TIMEOUT); ^^^^^^^^^^^^ rxBuf is uint8_t[10] ``` `rxBuf` is a **different, unrelated** buffer declared earlier in the same function, so this transmits **10 bytes from an 8-byte array** — a two-byte stack over-read, and two bytes of stack garbage follow every `SO` command the module receives. Fixed by sending `strlen(txBuf)`, which stops at the NUL that `sprintf()` wrote. `sizeof(txBuf)` would also stop the over-read but would still transmit the padding NULs. Since 1.2 no longer calls this function from `Init()`, it is only reachable if an application calls it directly — but it is a public API function, and the over-read is undefined behaviour either way. ## Fix 2 — three `-Wpointer-sign` warnings `HAL_UART_Transmit()` takes `const uint8_t *`; the function passes `char *` at three sites. Casts added, and the file now compiles warning-free. These warnings sit on the same lines as Fix 1, which is part of why the over-read went unnoticed. ## Not included — already fixed by 1.2 An earlier report covered `BluetoothUART_Init()` entering the module's command mode and rebooting the RN4678 on every boot. **1.2 removes that call from `Init()`**, so nothing is needed here. A suggested follow-up is recorded in `CODE_FIXES.md`: expose the configuration as an explicit `ConfigureModule()` rather than as a side effect of startup. ## Full write-up [CODE_FIXES.md](https://git.movitzaaron.com/movitz/yeep-144-library/src/branch/fix/status-delimiter-1.2/CODE_FIXES.md)

movitz added 1 commit 2026-10-28 14:38:15 +00:00

Fix SetStatusDelimiter: stack over-read and pointer-sign warnings ee18d27722

Two remaining issues in YEEP144_BluetoothUART.c, neither addressed by 1.2.

SetStatusDelimiter() transmits sizeof(rxBuf) = 10 bytes from an 8-byte stack
buffer (rxBuf is a different buffer declared earlier in the same function), so
two bytes of stack garbage follow every "SO" command the module receives. Send
strlen(txBuf) instead.

The same function passes char* to HAL_UART_Transmit(), which takes
const uint8_t*, producing three -Wpointer-sign warnings. They sit on the same
lines as the over-read, which is part of why it went unnoticed; with the casts
the file compiles warning-free.

See CODE_FIXES.md for the full write-up.

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/status-delimiter-1.2:fix/status-delimiter-1.2

git checkout fix/status-delimiter-1.2

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: movitz/yeep-144-library#1