From f27662712798d28b6dfd87155c83aa8823bfc9e9 Mon Sep 17 00:00:00 2001 From: 94xhn <87560781+94xhn@users.noreply.github.com> Date: Tue, 14 Jul 2026 10:16:57 +0800 Subject: [PATCH] Fix 1-byte out-of-bounds read in receive() scan loop The scan loop that advances rPtr past running-status data bytes evaluated buffer[rPtr + 1] before checking rPtr < (length - 1), due to && operand order. When the trailing data byte(s) of a packet are all below MIDI_TYPE, this reads one byte past the end of the receive buffer before the bounds check can short-circuit it. Swapping the operand order so the bounds check runs first fixes this; parsing behavior for valid packets is unchanged. --- src/BLEMIDI_Transport.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/BLEMIDI_Transport.h b/src/BLEMIDI_Transport.h index bc2b2de..a48fa3e 100644 --- a/src/BLEMIDI_Transport.h +++ b/src/BLEMIDI_Transport.h @@ -299,7 +299,7 @@ class BLEMIDI_Transport // Point to next non-data byte rPtr = lPtr; - while ((buffer[rPtr + 1] < MIDI_TYPE) && (rPtr < (length - 1))) + while ((rPtr < (length - 1)) && (buffer[rPtr + 1] < MIDI_TYPE)) rPtr++; if (!runningStatusContinuation)