Simple Weather Service : fix out of bounds access while creating Fore…

…cast instance.
InfiniTimeOrg · Dec 10, 2023 · 5836722 · 5836722
1 parent 79da9b0
commit 5836722
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/src/components/ble/SimpleWeatherService.cpp b/src/components/ble/SimpleWeatherService.cpp
@@ -19,6 +19,8 @@
 #include "SimpleWeatherService.h"
 #include <cstring>
 #include <nrf_log.h>
+#include <array>
+
 using namespace Pinetime::Controllers;
 
 namespace {
@@ -42,8 +44,10 @@ namespace {
     uint64_t timestamp = static_cast<uint64_t>(dataBuffer[2] + (dataBuffer[3] << 8) + (dataBuffer[4] << 16) + (dataBuffer[5] << 24) +
                                                ((uint64_t) dataBuffer[6] << 32) + ((uint64_t) dataBuffer[7] << 40) +
                                                ((uint64_t) dataBuffer[8] << 48) + ((uint64_t) dataBuffer[9] << 54));
-    uint8_t nbDays = dataBuffer[10];
-    std::array<SimpleWeatherService::Forecast::Day, 5> days;
+
+    std::array<SimpleWeatherService::Forecast::Day, SimpleWeatherService::MaxNbForecastDays> days;
+    const uint8_t nbDaysInBuffer = dataBuffer[10];
+    const uint8_t nbDays = std::min(SimpleWeatherService::MaxNbForecastDays, nbDaysInBuffer);
     for (int i = 0; i < nbDays; i++) {
       days[i] = SimpleWeatherService::Forecast::Day {dataBuffer[11 + (i * 3)], dataBuffer[12 + (i * 3)], dataBuffer[13 + (i * 3)]};
     }

diff --git a/src/components/ble/SimpleWeatherService.h b/src/components/ble/SimpleWeatherService.h
@@ -46,6 +46,8 @@ namespace Pinetime {
 
       int OnCommand(struct ble_gatt_access_ctxt* ctxt);
 
+      static constexpr uint8_t MaxNbForecastDays = 5;
+
       enum class Icons : uint8_t {
         Sun = 0,       // ClearSky
         CloudsSun = 1, // FewClouds
@@ -96,7 +98,7 @@ namespace Pinetime {
           uint8_t iconId;
         };
 
-        std::array<Day, 5> days;
+        std::array<Day, MaxNbForecastDays> days;
       };
 
       std::optional<CurrentWeather> Current() const;