From 265f83a4470419a3a89915b4cd07b572e148e5bb Mon Sep 17 00:00:00 2001
From: Armel FAUVEAU <armel.fauveau@globalis-ms.com>
Date: Mon, 24 Aug 2026 02:46:58 +0200
Subject: [PATCH] Reject oversized EEPROM read commands (Thanks @BB-KING777)

---
 App/app/uart.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/App/app/uart.c b/App/app/uart.c
index e53faed7..54eb91b0 100644
--- a/App/app/uart.c
+++ b/App/app/uart.c
@@ -403,6 +403,10 @@ static void CMD_051B(uint32_t Port, const uint8_t *pBuffer)
         gFmRadioCountdown_500ms = fm_radio_countdown_500ms;
     #endif
 
+    // Reject reads that do not fit in the fixed-size reply buffer.
+    if (pCmd->Size > sizeof(Reply.Data.Data))
+        return;
+
     memset(&Reply, 0, sizeof(Reply));
     Reply.Header.ID   = 0x051C;
     Reply.Header.Size = pCmd->Size + 4;
@@ -416,7 +420,7 @@ static void CMD_051B(uint32_t Port, const uint8_t *pBuffer)
     {
         EEPROM_ReadBuffer(pCmd->Offset, Reply.Data.Data, pCmd->Size);
     }
-    
+
     SendReply(Port, &Reply, pCmd->Size + 8);
 }