Guard MSP2_SENSOR_* receivers against short payloads

src/main/drivers/barometer/barometer_msp.c

@@ -78,8 +78,12 @@ static bool mspBaroCalculate(baroDev_t * baro, int32_t *pressure, int32_t *tempe
     return true;
 }
 
-void mspBaroReceiveNewData(uint8_t * bufferPtr)
+void mspBaroReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize)
 {
+    if (dataSize < sizeof(mspSensorBaroDataMessage_t)) {
+        return;
+    }
+
     const mspSensorBaroDataMessage_t * pkt = (const mspSensorBaroDataMessage_t *)bufferPtr;
 
     mspBaroPressure = pkt->pressurePa;

src/main/drivers/barometer/barometer_msp.h

@@ -26,4 +26,4 @@
 
 struct baroDev_s;
 bool mspBaroDetect(struct baroDev_s *baro);
-void mspBaroReceiveNewData(uint8_t * bufferPtr);
+void mspBaroReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize);

src/main/drivers/compass/compass_msp.c

@@ -58,8 +58,12 @@ static bool mspMagInit(magDev_t *magDev)
     return true;
 }
 
-void mspMagReceiveNewData(uint8_t * bufferPtr)
+void mspMagReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize)
 {
+    if (dataSize < sizeof(mspSensorCompassDataMessage_t)) {
+        return;
+    }
+
     const mspSensorCompassDataMessage_t * pkt = (const mspSensorCompassDataMessage_t *)bufferPtr;
 
     mspMagData[X] = (float) pkt->magX;

src/main/drivers/compass/compass_msp.h

@@ -25,4 +25,4 @@
 #pragma once
 
 bool mspMagDetect(struct magDev_s *mag);
-void mspMagReceiveNewData(uint8_t * bufferPtr);
+void mspMagReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize);

src/main/drivers/pitotmeter/pitotmeter_msp.c

@@ -72,8 +72,12 @@ static void mspPitotCalculate(pitotDev_t *pitot, float *pressure, float *tempera
     }
 }
 
-void mspPitotmeterReceiveNewData(uint8_t * bufferPtr)
+void mspPitotmeterReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize)
 {
+    if (dataSize < sizeof(mspSensorAirspeedDataMessage_t)) {
+        return;
+    }
+
     const mspSensorAirspeedDataMessage_t * pkt = (const mspSensorAirspeedDataMessage_t *)bufferPtr;
 
     mspPitotPressure = pkt->diffPressurePa;

src/main/drivers/pitotmeter/pitotmeter_msp.h

@@ -26,4 +26,4 @@
 
 struct pitotDev_s;
 bool mspPitotmeterDetect(struct pitotDev_s *pitot);
-void mspPitotmeterReceiveNewData(uint8_t * bufferPtr);
+void mspPitotmeterReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize);

src/main/fc/fc_msp.c

@@ -5088,42 +5088,41 @@ bool mspFCProcessInOutCommand(uint16_t cmdMSP, sbuf_t *dst, sbuf_t *src, mspResu
 static mspResult_e mspProcessSensorCommand(uint16_t cmdMSP, sbuf_t *src)
 {
     int dataSize = sbufBytesRemaining(src);
-    UNUSED(dataSize);
 
     switch (cmdMSP) {
 #if defined(USE_RANGEFINDER_MSP)
         case MSP2_SENSOR_RANGEFINDER:
-            mspRangefinderReceiveNewData(sbufPtr(src));
+            mspRangefinderReceiveNewData(sbufPtr(src), dataSize);
             break;
 #endif
 
 #if defined(USE_OPFLOW_MSP)
         case MSP2_SENSOR_OPTIC_FLOW:
-            mspOpflowReceiveNewData(sbufPtr(src));
+            mspOpflowReceiveNewData(sbufPtr(src), dataSize);
             break;
 #endif
 
 #if defined(USE_GPS_PROTO_MSP)
         case MSP2_SENSOR_GPS:
-            mspGPSReceiveNewData(sbufPtr(src));
+            mspGPSReceiveNewData(sbufPtr(src), dataSize);
             break;
 #endif
 
 #if defined(USE_MAG_MSP)
         case MSP2_SENSOR_COMPASS:
-            mspMagReceiveNewData(sbufPtr(src));
+            mspMagReceiveNewData(sbufPtr(src), dataSize);
             break;
 #endif
 
 #if defined(USE_BARO_MSP)
         case MSP2_SENSOR_BAROMETER:
-            mspBaroReceiveNewData(sbufPtr(src));
+            mspBaroReceiveNewData(sbufPtr(src), dataSize);
             break;
 #endif
 
 #if defined(USE_PITOT_MSP)
         case MSP2_SENSOR_AIRSPEED:
-            mspPitotmeterReceiveNewData(sbufPtr(src));
+            mspPitotmeterReceiveNewData(sbufPtr(src), dataSize);
             break;
 #endif
 

src/main/io/gps.h

@@ -179,11 +179,14 @@ bool isGPSHealthy(void);
 bool isGPSHeadingValid(void);
 struct serialPort_s;
 void gpsEnablePassthrough(struct serialPort_s *gpsPassthroughPort);
-void mspGPSReceiveNewData(const uint8_t * bufferPtr);
+
+void mspGPSReceiveNewData(const uint8_t * bufferPtr, unsigned int dataSize);
+
 void dronecanGPSReceiveGNSSFix(const struct uavcan_equipment_gnss_Fix * pgnssFix);
 void dronecanGPSReceiveGNSSFix2(const struct uavcan_equipment_gnss_Fix2 * pgnssFix2);
 void dronecanGPSReceiveGNSSAuxiliary(const struct uavcan_equipment_gnss_Auxiliary * pgnssAux);
 
+
 const char *getGpsHwVersion(void);
 uint8_t getGpsProtoMajorVersion(void);
 uint8_t getGpsProtoMinorVersion(void);

src/main/io/gps_msp.c

@@ -77,8 +77,12 @@ static uint8_t gpsMapFixType(uint8_t mspFixType)
     return GPS_NO_FIX;
 }
 
-void mspGPSReceiveNewData(const uint8_t * bufferPtr)
+void mspGPSReceiveNewData(const uint8_t * bufferPtr, unsigned int dataSize)
 {
+    if (dataSize < sizeof(mspSensorGpsDataMessage_t)) {
+        return;
+    }
+
     const mspSensorGpsDataMessage_t * pkt = (const mspSensorGpsDataMessage_t *)bufferPtr;
 
     gpsSolDRV.fixType   = gpsMapFixType(pkt->fixType);

src/main/io/headtracker_msp.c

@@ -55,7 +55,7 @@ void mspHeadTrackerInit(void)
 
 void mspHeadTrackerReceiverNewData(uint8_t *data, unsigned int dataSize)
 {
-    if(dataSize != sizeof(headtrackerMspMessage_t)) {
+    if(dataSize < sizeof(headtrackerMspMessage_t)) {
         SD(fprintf(stderr, "[headTracker]: invalid data size %d\n", dataSize));
         static int errorCount = 0;
         DEBUG_SET(DEBUG_HEADTRACKING, 7, errorCount++);

src/main/io/opflow.h

@@ -32,4 +32,4 @@
 extern virtualOpflowVTable_t opflowCxofVtable;
 extern virtualOpflowVTable_t opflowMSPVtable;
 
-void mspOpflowReceiveNewData(uint8_t * bufferPtr);
+void mspOpflowReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize);

src/main/io/opflow_msp.c

@@ -71,8 +71,12 @@ static bool mspOpflowUpdate(opflowData_t * data)
     return false;
 }
 
-void mspOpflowReceiveNewData(uint8_t * bufferPtr)
+void mspOpflowReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize)
 {
+    if (dataSize < sizeof(mspSensorOpflowDataMessage_t)) {
+        return;
+    }
+
     const timeUs_t currentTimeUs = micros();
     const mspSensorOpflowDataMessage_t * pkt = (const mspSensorOpflowDataMessage_t *)bufferPtr;
 

src/main/io/rangefinder.h

@@ -35,5 +35,5 @@ extern virtualRangefinderVTable_t rangefinderUSD1Vtable;
 extern virtualRangefinderVTable_t rangefinderNanoradarVtable; //NRA15/NRA24
 extern virtualRangefinderVTable_t rangefinderFakeVtable;
 
-void mspRangefinderReceiveNewData(uint8_t * bufferPtr);
+void mspRangefinderReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize);
 void fakeRangefindersSetData(int32_t data);

src/main/io/rangefinder_msp.c

@@ -72,8 +72,12 @@ static int32_t mspRangefinderGetDistance(void)
     }
 }
 
-void mspRangefinderReceiveNewData(uint8_t * bufferPtr)
+void mspRangefinderReceiveNewData(uint8_t * bufferPtr, unsigned int dataSize)
 {
+    if (dataSize < sizeof(mspSensorRangefinderDataMessage_t)) {
+        return;
+    }
+
     const mspSensorRangefinderDataMessage_t * pkt = (const mspSensorRangefinderDataMessage_t *)bufferPtr;
 
     sensorData = pkt->distanceMm / 10;