LP-522 GCS: DFUObject::CRCFromQBArray - allocate temp buffer on heap

Author: mindnever

ground/gcs/src/plugins/uploader/dfu.cpp

@@ -1031,11 +1031,12 @@ quint32 DFUObject::CRC32WideFast(quint32 Crc, quint32 Size, quint32 *Buffer)
  */
 quint32 DFUObject::CRCFromQBArray(QByteArray array, quint32 Size)
 {
-    quint32 pad = Size - array.length();
+    quint32 pad   = Size - array.length();
 
     array.append(QByteArray(pad, 255));
-    quint32 t[Size / 4];
-    for (int x = 0; x < array.length() / 4; x++) {
+    int num_words = Size / 4;
+    quint32 *t    = (quint32 *)malloc(Size);
+    for (int x = 0; x < num_words; x++) {
         quint32 aux = 0;
         aux  = (char)array[x * 4 + 3] & 0xFF;
         aux  = aux << 8;
@@ -1046,7 +1047,10 @@ quint32 DFUObject::CRCFromQBArray(QByteArray array, quint32 Size)
         aux += (char)array[x * 4 + 0] & 0xFF;
         t[x] = aux;
     }
-    return DFUObject::CRC32WideFast(0xFFFFFFFF, Size / 4, (quint32 *)t);
+    quint32 ret = DFUObject::CRC32WideFast(0xFFFFFFFF, num_words, t);
+    free(t);
+
+    return ret;
 }
 
 /**