It was possible to overflow the dynamic macro list if the dynamicmacros

data structure was zeroed out.
keyboardio · Mar 5, 2024 · 6bd594b · 6bd594b
1 parent 8235b59
commit 6bd594b
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/plugins/Kaleidoscope-DynamicMacros/src/kaleidoscope/plugin/DynamicMacros.cpp b/plugins/Kaleidoscope-DynamicMacros/src/kaleidoscope/plugin/DynamicMacros.cpp
@@ -41,7 +41,7 @@ uint8_t DynamicMacros::updateDynamicMacroCache() {
 
   map_[0] = 0;
 
-  while (pos < storage_base_ + storage_size_) {
+  while (pos < storage_base_ + storage_size_ && current_id < MAX_MACRO_COUNT_) {
     macro = Runtime.storage().read(pos++);
     switch (macro) {
     case MACRO_ACTION_STEP_EXPLICIT_REPORT:

diff --git a/plugins/Kaleidoscope-DynamicMacros/src/kaleidoscope/plugin/DynamicMacros.h b/plugins/Kaleidoscope-DynamicMacros/src/kaleidoscope/plugin/DynamicMacros.h
@@ -48,9 +48,10 @@ class DynamicMacros : public kaleidoscope::Plugin {
   void play(uint8_t seq_id);
 
  private:
+  static const uint8_t MAX_MACRO_COUNT_ = 32;
   uint16_t storage_base_;
   uint16_t storage_size_;
-  uint16_t map_[32];
+  uint16_t map_[MAX_MACRO_COUNT_];
   uint8_t macro_count_;
   uint8_t updateDynamicMacroCache();