Skip to content

Potential bug in rangefinder_teraranger_evo.c #11310

@mart1npetroff

Description

@mart1npetroff

Current Behavior

Due to limited documentation regarding TeraRanger Evo rangefinder support in INAV, I reviewed the driver implementation to understand what is currently supported.

While inspecting the code (with some assistance from ChatGPT for static analysis), I noticed two potential issues in rangefinder_teraranger_evo.c.
Since I am not deeply familiar with all design decisions in the codebase, I would appreciate confirmation from devs (or @error414 ) whether these are real bugs or intentional behavior.

Potential Issue 1 – Zero-length buffer used with busWriteBuf()

uint8_t triggerValue[0];
busWriteBuf(rangefinder->busDev, TERARANGER_EVO_I2C_REGISTRY_TRIGGER_READING, triggerValue, 1);

A zero-length array is declared, but busWriteBuf() is instructed to send 1 byte.
This results in an out-of-bounds read and undefined behavior — effectively transmitting a random byte from memory over I²C.

Potential Issue 2 – Incorrect register argument in periodic trigger

In teraRangerUpdate():

busWriteBuf(rangefinder->busDev, TERARANGER_EVO_I2C_ADDRESS, triggerValue, 1);

The second parameter of busWriteBuf() is a register/command, not the I²C device address.
Here TERARANGER_EVO_I2C_ADDRESS (0x31) is used instead of TERARANGER_EVO_I2C_REGISTRY_TRIGGER_READING (0x00).
This may result in invalid command writes to the sensor.

Suggested solution(s)

For Issue 1:
Replace the zero-length array with a valid trigger byte:

static const uint8_t triggerValue = 0x00;
busWriteBuf(rangefinder->busDev, TERARANGER_EVO_I2C_REGISTRY_TRIGGER_READING, &triggerValue, 1);

For Issue 2:
Use the correct trigger register:

busWriteBuf(rangefinder->busDev, TERARANGER_EVO_I2C_REGISTRY_TRIGGER_READING, &triggerValue, 1);

Additional context

I would also appreciate confirmation from devs (or @error414 ) regarding which exact TeraRanger Evo models/firmware variants are officially supported by this driver (e.g. Evo 60m single-point with I²C/UART backboard).

Documentation around Evo support is currently sparse, so clarification would be very helpful for users.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions