fix critical array overrun bug (incomingUBX->payload[] index was only checked against MAX_PAYLOAD_SIZE, but incomingUBX can also be packetAck or packetBuf which have much smaller buffers of only 2 bytes)

Author: nelarsen

src/SparkFun_Ublox_Arduino_Library.cpp

@@ -760,6 +760,9 @@ void SFE_UBLOX_GPS::processRTCM(uint8_t incoming)
 //a subset of bytes within a larger packet.
 void SFE_UBLOX_GPS::processUBX(uint8_t incoming, ubxPacket *incomingUBX, uint8_t requestedClass, uint8_t requestedID)
 {
+ size_t max_payload_size = (activePacketBuffer == SFE_UBLOX_PACKET_PACKETCFG) ? MAX_PAYLOAD_SIZE : 2;
+ bool overrun = false;
+
  //Add all incoming bytes to the rolling checksum
  //Stop at len+4 as this is the checksum bytes to that should not be added to the rolling checksum
  if (incomingUBX->counter < incomingUBX->len + 4)
@@ -931,18 +934,22 @@ void SFE_UBLOX_GPS::processUBX(uint8_t incoming, ubxPacket *incomingUBX, uint8_t
  if ((incomingUBX->counter - 4) >= startingSpot)
  {
  //Check to see if we have room for this byte
- if (((incomingUBX->counter - 4) - startingSpot) < MAX_PAYLOAD_SIZE) //If counter = 208, starting spot = 200, we're good to record.
+ if (((incomingUBX->counter - 4) - startingSpot) < max_payload_size) //If counter = 208, starting spot = 200, we're good to record.
  {
  incomingUBX->payload[incomingUBX->counter - 4 - startingSpot] = incoming; //Store this byte into payload array
  }
+ else
+ {
+ overrun = true;
+ }
  }
  }
  }
 
  //Increment the counter
  incomingUBX->counter++;
 
- if (incomingUBX->counter == MAX_PAYLOAD_SIZE)
+ if (overrun or incomingUBX->counter == MAX_PAYLOAD_SIZE)
  {
  //Something has gone very wrong
  currentSentence = NONE; //Reset the sentence to being looking for a new start char