-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Description
Current Behavior
Due to limited documentation regarding TeraRanger Evo rangefinder support in INAV, I reviewed the driver implementation to understand what is currently supported.
While inspecting the code (with some assistance from ChatGPT for static analysis), I noticed two potential issues in rangefinder_teraranger_evo.c.
Since I am not deeply familiar with all design decisions in the codebase, I would appreciate confirmation from devs (or @error414 ) whether these are real bugs or intentional behavior.
Potential Issue 1 – Zero-length buffer used with busWriteBuf()
uint8_t triggerValue[0];
busWriteBuf(rangefinder->busDev, TERARANGER_EVO_I2C_REGISTRY_TRIGGER_READING, triggerValue, 1);
A zero-length array is declared, but busWriteBuf() is instructed to send 1 byte.
This results in an out-of-bounds read and undefined behavior — effectively transmitting a random byte from memory over I²C.
Potential Issue 2 – Incorrect register argument in periodic trigger
In teraRangerUpdate():
busWriteBuf(rangefinder->busDev, TERARANGER_EVO_I2C_ADDRESS, triggerValue, 1);
The second parameter of busWriteBuf() is a register/command, not the I²C device address.
Here TERARANGER_EVO_I2C_ADDRESS (0x31) is used instead of TERARANGER_EVO_I2C_REGISTRY_TRIGGER_READING (0x00).
This may result in invalid command writes to the sensor.
Suggested solution(s)
For Issue 1:
Replace the zero-length array with a valid trigger byte:
static const uint8_t triggerValue = 0x00;
busWriteBuf(rangefinder->busDev, TERARANGER_EVO_I2C_REGISTRY_TRIGGER_READING, &triggerValue, 1);
For Issue 2:
Use the correct trigger register:
busWriteBuf(rangefinder->busDev, TERARANGER_EVO_I2C_REGISTRY_TRIGGER_READING, &triggerValue, 1);
Additional context
I would also appreciate confirmation from devs (or @error414 ) regarding which exact TeraRanger Evo models/firmware variants are officially supported by this driver (e.g. Evo 60m single-point with I²C/UART backboard).
Documentation around Evo support is currently sparse, so clarification would be very helpful for users.