rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-09-11 18:29:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Replace VLAs with heap alloc in lfdemod signal helpers

Browse Source 
Using "data load" on very large trace files (e.g. dumps with 700k samples,
such as COTAG dumps) was causing crashes on some platforms due to stack overflow
since VLA temporary buffers were used.

Replace VLAs in computeSignalProperties() and removeSignalOffset() with
heap-allocated buffers instead.
This commit is contained in:
towelbyte
2026-06-13 00:33:24 +02:00
parent e3d2797411
commit 2e35b95a7c
1 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/lfdemod.c
+14 -6
View File
@@ -110,12 +110,16 @@ void computeSignalProperties(const uint8_t *samples, uint32_t size) {
uint32_t offset_size = size - SIGNAL_IGNORE_FIRST_SAMPLES;
#ifndef ON_DEVICE
uint8_t tmp[offset_size];
memcpy(tmp, samples + SIGNAL_IGNORE_FIRST_SAMPLES, sizeof(tmp));
qsort(tmp, sizeof(tmp), sizeof(uint8_t), cmp_uint8);
uint8_t *tmp = calloc(offset_size, sizeof(uint8_t));
if (tmp == NULL)
return;
memcpy(tmp, samples + SIGNAL_IGNORE_FIRST_SAMPLES, offset_size);
qsort(tmp, offset_size, sizeof(uint8_t), cmp_uint8);
uint8_t low10 = 0.5 * (tmp[(int)(offset_size * 0.1)] + tmp[(int)((offset_size - 1) * 0.1)]);
uint8_t hi90 = 0.5 * (tmp[(int)(offset_size * 0.9)] + tmp[(int)((offset_size - 1) * 0.9)]);
free(tmp);
uint32_t cnt = 0;
for (uint32_t i = SIGNAL_IGNORE_FIRST_SAMPLES; i < size; i++) {
@@ -161,12 +165,16 @@ void removeSignalOffset(uint8_t *samples, uint32_t size) {
#ifndef ON_DEVICE
uint8_t tmp[offset_size];
memcpy(tmp, samples + SIGNAL_IGNORE_FIRST_SAMPLES, sizeof(tmp));
qsort(tmp, sizeof(tmp), sizeof(uint8_t), cmp_uint8);
uint8_t *tmp = calloc(offset_size, sizeof(uint8_t));
if (tmp == NULL)
return;
memcpy(tmp, samples + SIGNAL_IGNORE_FIRST_SAMPLES, offset_size);
qsort(tmp, offset_size, sizeof(uint8_t), cmp_uint8);
uint8_t low10 = 0.5 * (tmp[(int)(offset_size * 0.05)] + tmp[(int)((offset_size - 1) * 0.05)]);
uint8_t hi90 = 0.5 * (tmp[(int)(offset_size * 0.95)] + tmp[(int)((offset_size - 1) * 0.95)]);
free(tmp);
int32_t cnt = 0;
for (uint32_t i = SIGNAL_IGNORE_FIRST_SAMPLES; i < size; i++) {