From 2e35b95a7cd9fa9befc1bb8fda1654ad1c10ee57 Mon Sep 17 00:00:00 2001 From: towelbyte Date: Sat, 13 Jun 2026 00:33:24 +0200 Subject: [PATCH] Fix: Replace VLAs with heap alloc in lfdemod signal helpers Using "data load" on very large trace files (e.g. dumps with 700k samples, such as COTAG dumps) was causing crashes on some platforms due to stack overflow since VLA temporary buffers were used. Replace VLAs in computeSignalProperties() and removeSignalOffset() with heap-allocated buffers instead. --- common/lfdemod.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/common/lfdemod.c b/common/lfdemod.c index 21ef5469a..67f855fbd 100644 --- a/common/lfdemod.c +++ b/common/lfdemod.c @@ -110,12 +110,16 @@ void computeSignalProperties(const uint8_t *samples, uint32_t size) { uint32_t offset_size = size - SIGNAL_IGNORE_FIRST_SAMPLES; #ifndef ON_DEVICE - uint8_t tmp[offset_size]; - memcpy(tmp, samples + SIGNAL_IGNORE_FIRST_SAMPLES, sizeof(tmp)); - qsort(tmp, sizeof(tmp), sizeof(uint8_t), cmp_uint8); + uint8_t *tmp = calloc(offset_size, sizeof(uint8_t)); + if (tmp == NULL) + return; + memcpy(tmp, samples + SIGNAL_IGNORE_FIRST_SAMPLES, offset_size); + qsort(tmp, offset_size, sizeof(uint8_t), cmp_uint8); uint8_t low10 = 0.5 * (tmp[(int)(offset_size * 0.1)] + tmp[(int)((offset_size - 1) * 0.1)]); uint8_t hi90 = 0.5 * (tmp[(int)(offset_size * 0.9)] + tmp[(int)((offset_size - 1) * 0.9)]); + free(tmp); + uint32_t cnt = 0; for (uint32_t i = SIGNAL_IGNORE_FIRST_SAMPLES; i < size; i++) { @@ -161,12 +165,16 @@ void removeSignalOffset(uint8_t *samples, uint32_t size) { #ifndef ON_DEVICE - uint8_t tmp[offset_size]; - memcpy(tmp, samples + SIGNAL_IGNORE_FIRST_SAMPLES, sizeof(tmp)); - qsort(tmp, sizeof(tmp), sizeof(uint8_t), cmp_uint8); + uint8_t *tmp = calloc(offset_size, sizeof(uint8_t)); + if (tmp == NULL) + return; + memcpy(tmp, samples + SIGNAL_IGNORE_FIRST_SAMPLES, offset_size); + qsort(tmp, offset_size, sizeof(uint8_t), cmp_uint8); uint8_t low10 = 0.5 * (tmp[(int)(offset_size * 0.05)] + tmp[(int)((offset_size - 1) * 0.05)]); uint8_t hi90 = 0.5 * (tmp[(int)(offset_size * 0.95)] + tmp[(int)((offset_size - 1) * 0.95)]); + free(tmp); + int32_t cnt = 0; for (uint32_t i = SIGNAL_IGNORE_FIRST_SAMPLES; i < size; i++) {