Fix rogue writes from within param_load()

Here we are iterating over parameter indices but using byte length for bounds, meaning we iterate to four times the actual number of parameters. The subsequent param_check returns false for each of the overrun indices, causing an out-of-bounds write each time. This explains commit 70b306a (Disable AT mode after reset, 2020-02-12).
ArduPilot · Mar 22, 2022 · 4d436d6 · 4d436d6
1 parent 05ae8c8
commit 4d436d6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Firmware/radio/parameters.c b/Firmware/radio/parameters.c
@@ -284,7 +284,7 @@ __critical {
 		return false;
 	}
 
-	for (i = 0; i < sizeof(parameter_values); i++) {
+	for (i = 0; i < PARAM_MAX; i++) {
 		if (!param_check(i, parameter_values[i])) {
 			parameter_values[i] = parameter_info[i].default_value;
 		}