From 13f04f65b1bf444729c9a000846c176fdcdc4280 Mon Sep 17 00:00:00 2001 From: Old-Ding Date: Mon, 6 Jul 2026 04:01:21 +0800 Subject: [PATCH] examples: nrf24l01_btle: Fix RX terminator bounds nrf24_read() reads up to the nRF24L01 maximum payload length and then appends a NUL terminator for the receive buffer. A full 32-byte payload can therefore write one byte past the local rbuf[32]. Reserve one extra byte for the terminator while keeping the read length capped at NRF24L01_MAX_PAYLOAD_LEN. Dump the number of bytes actually received in the debug path. Signed-off-by: Old-Ding --- examples/nrf24l01_btle/nrf24l01_btle.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/nrf24l01_btle/nrf24l01_btle.c b/examples/nrf24l01_btle/nrf24l01_btle.c index 6e1490f45..d7f24ab3c 100644 --- a/examples/nrf24l01_btle/nrf24l01_btle.c +++ b/examples/nrf24l01_btle/nrf24l01_btle.c @@ -484,9 +484,9 @@ int nrf24_read(int wl_fd) { int ret; uint32_t pipeno; - uint8_t rbuf[32]; + uint8_t rbuf[NRF24L01_MAX_PAYLOAD_LEN + 1]; - ret = read(wl_fd, rbuf, sizeof(rbuf)); + ret = read(wl_fd, rbuf, NRF24L01_MAX_PAYLOAD_LEN); if (ret < 0) { perror("Error reading packet\n"); @@ -512,7 +512,7 @@ int nrf24_read(int wl_fd) #ifdef CONFIG_DEBUG_WIRELESS syslog(LOG_INFO, "Message received : (on pipe %d)\n", pipeno); - nrf24_dumpbuffer("Hex Dump", &rbuf[0], 32); + nrf24_dumpbuffer("Hex Dump", &rbuf[0], ret); #endif return 0; }