FreeIMU::zeroGyro:: array index out of bounds. rawValues for pressure and temperature are written outside array

Bug #1040860 reported by Christian Koschutnig
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
FreeIMU
Fix Committed
Undecided
Unassigned

Bug Description

check array size in declaration @line 245 in zeroGyro and usage of this array in line 182 and 186 ( method getRawValues );

--SNIP --

243 void FreeIMU::zeroGyro() {
244 const int totSamples = 3;
245 int raw[9];
246 float tmpOffsets[] = {0,0,0};

247 for (int i = 0; i < totSamples; i++){
248 getRawValues(raw);

-- SNAP --

if you jump into getRawValues line

-- SNIP --

167 void FreeIMU::getRawValues(int * raw_values) {
...
...
...
181 if(temp != NULL) {
182 raw_values[9] = temp * 100;
183 }
184 press = baro.getPressure(MS561101BA_OSR_4096);
185 if(press != NULL) {
186 raw_values[10] = press * 100;

--SNAP--

you can see that array pos 9, and 10 will be written!! as of declaration max index is 8.

ciao, christian

Related branches

Revision history for this message
Fabio Varesano (fabio-varesano) wrote :

Fixed in r8. Thanks for reporting the issue.

Changed in freeimu:
status: New → Fix Committed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.