From 4b28a1d9b532700332129c7a9740e415604beab0 Mon Sep 17 00:00:00 2001
From: Paul <paul@derbyshire.nl>
Date: Sun, 23 Jun 2019 23:55:16 +0200
Subject: [PATCH] add check for max telegram length

---
 src/emsuart.cpp | 20 +++++---------------
 src/emsuart.h   |  2 +-
 2 files changed, 6 insertions(+), 16 deletions(-)

diff --git a/src/emsuart.cpp b/src/emsuart.cpp
index 0afcccd56..8f52e7c72 100644
--- a/src/emsuart.cpp
+++ b/src/emsuart.cpp
@@ -67,9 +67,9 @@ static void ICACHE_FLASH_ATTR emsuart_recvTask(os_event_t * events) {
 
     // validate and transmit the EMS buffer, excluding the BRK
     if (length == 2) {
-        // it's a poll or status code, single byte
+        // it's a poll or status code, single byte and ok to send on
         ems_parseTelegram((uint8_t *)pCurrent->buffer, 1);
-    } else if ((length > 4) && (pCurrent->buffer[length - 2] != 0x00)) {
+    } else if ((length > 4) && (length <= EMS_MAXBUFFERSIZE) && (pCurrent->buffer[length - 2] != 0x00)) {
         // ignore double BRK at the end, possibly from the Tx loopback
         // also telegrams with no data value
         ems_parseTelegram((uint8_t *)pCurrent->buffer, length - 1); // transmit EMS buffer, excluding the BRK
@@ -159,16 +159,6 @@ void ICACHE_FLASH_ATTR emsuart_start() {
     ETS_UART_INTR_ENABLE();
 }
 
-/*
- * set loopback mode and clear Tx/Rx FIFO
- */
-static inline void ICACHE_FLASH_ATTR emsuart_loopback(bool enable) {
-    if (enable)
-        USC0(EMSUART_UART) |= (1 << UCLBE); // enable loopback
-    else
-        USC0(EMSUART_UART) &= ~(1 << UCLBE); // disable loopback
-}
-
 /*
  * Send to Tx, ending with a <BRK>
  */
@@ -205,7 +195,7 @@ void ICACHE_FLASH_ATTR emsuart_tx_buffer(uint8_t * buf, uint8_t len) {
     // worst case, we'll see an additional Rx-BRK...
     if (!(USIS(EMSUART_UART) & (1 << UIBD))) {
         // no bus collision - send terminating BRK signal
-        emsuart_loopback(true);
+        USC0(EMSUART_UART) |= (1 << UCLBE); // enable loopback
         USC0(EMSUART_UART) |= (1 << UCBRK); // set <BRK>
 
         // wait until BRK detected...
@@ -215,8 +205,8 @@ void ICACHE_FLASH_ATTR emsuart_tx_buffer(uint8_t * buf, uint8_t len) {
 
         USC0(EMSUART_UART) &= ~(1 << UCBRK); // clear <BRK>
 
-        USIC(EMSUART_UART) = (1 << UIBD); // clear BRK detect IRQ
-        emsuart_loopback(false);          // disable loopback mode
+        USIC(EMSUART_UART) = (1 << UIBD);    // clear BRK detect IRQ
+        USC0(EMSUART_UART) &= ~(1 << UCLBE); // disable loopback
     }
 
     ETS_UART_INTR_ENABLE(); // receive anything from FIFO...
diff --git a/src/emsuart.h b/src/emsuart.h
index cd57cd4da..e59d72024 100644
--- a/src/emsuart.h
+++ b/src/emsuart.h
@@ -13,7 +13,7 @@
 #define EMSUART_CONFIG 0x1C // 8N1 (8 bits, no stop bits, 1 parity)
 #define EMSUART_BAUD 9600   // uart baud rate for the EMS circuit
 
-#define EMS_MAXBUFFERS 10    // buffers for circular filling to avoid collisions
+#define EMS_MAXBUFFERS 5    // buffers for circular filling to avoid collisions
 #define EMS_MAXBUFFERSIZE 32 // max size of the buffer. packets are max 32 bytes to support EMS 1.0
 
 #define EMSUART_BIT_TIME 104 // bit time @9600 baud