Reserve the [Exit] slot when splitting canned messages (#11095)

splitConfiguredMessages capped the split loop at
CANNED_MESSAGE_MODULE_MESSAGE_MAX_COUNT and then appended [Exit]
unconditionally, so messages[] could be written one past its last index
and messagesCount could exceed the array size.
This commit is contained in:
Thomas Göttgens
2026-07-21 00:31:21 +02:00
committed by GitHub
parent 0199a1f3ff
commit e061335055

View File

@@ -179,7 +179,7 @@ int CannedMessageModule::splitConfiguredMessages()
while (i < upTo) {
if (this->messageBuffer[i] == '|') {
this->messageBuffer[i] = '\0'; // End previous message
if (tempCount >= CANNED_MESSAGE_MODULE_MESSAGE_MAX_COUNT)
if (tempCount >= CANNED_MESSAGE_MODULE_MESSAGE_MAX_COUNT - 1)
break;
tempMessages[tempCount++] = (this->messageBuffer + i + 1);
}