From 225b30018ae10a69c33abc40b22ad3cd9f159f67 Mon Sep 17 00:00:00 2001
From: strawmanbobi <strawmanbobi@163.com>
Date: Tue, 13 Jan 2026 16:31:37 +0800
Subject: [PATCH] corrected memory leak issue and added some boundary check

---
 decoder/src/include/ir_defs.h |  2 +-
 decoder/src/ir_decode.c       |  7 +++++++
 decoder/src/ir_decode_test.c  | 12 +++++++++---
 decoder/src/ir_tv_control.c   | 24 ++++++++++++++++++++++++
 4 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/decoder/src/include/ir_defs.h b/decoder/src/include/ir_defs.h
index 8b437ba..aede9d7 100644
--- a/decoder/src/include/ir_defs.h
+++ b/decoder/src/include/ir_defs.h
@@ -62,7 +62,7 @@ void noprint(const char *fmt, ...);
 #else
 #define ir_printf noprint
 #endif
-#define USER_DATA_SIZE 1636
+#define USER_DATA_SIZE 2048
 // #define USER_DATA_SIZE 4096
 
 #ifdef __cplusplus
diff --git a/decoder/src/ir_decode.c b/decoder/src/ir_decode.c
index 2c45d0f..eb314fb 100644
--- a/decoder/src/ir_decode.c
+++ b/decoder/src/ir_decode.c
@@ -791,6 +791,13 @@ UINT16 ir_decode_combo(const UINT8 category, const UINT8 sub_category,
         return IR_DECODE_FAILED;
     }
 
+    if (sub_category < SUB_CATEGORY_QUATERNARY ||
+        sub_category >= SUB_CATEGORY_NEXT)
+    {
+        ir_printf("wrong remote sub category : %d\n", sub_category);
+        return IR_DECODE_FAILED;
+    }
+
     remote_category = (t_remote_category) category;
 
     if (key_code < 0 || key_code >= KEY_CODE_MAX[remote_category])
diff --git a/decoder/src/ir_decode_test.c b/decoder/src/ir_decode_test.c
index 0be77e2..83bd855 100644
--- a/decoder/src/ir_decode_test.c
+++ b/decoder/src/ir_decode_test.c
@@ -69,6 +69,7 @@ static INT8 decode_as_ac(char *file_name)
     int first_time = 1;
     int length = 0;
     int index = 0;
+    INT8 ret_val = IR_DECODE_SUCCEEDED;
 
     // get status
     UINT8 supported_mode = 0x00;
@@ -101,8 +102,8 @@ static INT8 decode_as_ac(char *file_name)
 
     if (IR_DECODE_FAILED == ir_file_open(REMOTE_CATEGORY_AC, 0, file_name))
     {
-        ir_close();
-        return IR_DECODE_FAILED;
+        ret_val = IR_DECODE_FAILED;
+        goto _exit;
     }
 
     do
@@ -246,9 +247,14 @@ static INT8 decode_as_ac(char *file_name)
         }
     } while (TRUE);
 
+_exit:
     ir_close();
 
-    return IR_DECODE_SUCCEEDED;
+    if (NULL != ac_status) {
+        free(ac_status);
+    }
+
+    return ret_val;
 }
 
 static INT8 decode_as_tv(char *file_name, UINT8 ir_hex_encode)
diff --git a/decoder/src/ir_tv_control.c b/decoder/src/ir_tv_control.c
index 6d3990a..e922dc3 100644
--- a/decoder/src/ir_tv_control.c
+++ b/decoder/src/ir_tv_control.c
@@ -249,8 +249,16 @@ static void print_ir_time(t_ir_data *data, UINT8 key_index, UINT16 *ir_time)
                     }
                     else if (ir_level == IRDA_LEVEL_LOW)
                     {
+                        if (time_index + 1 > USER_DATA_SIZE) {
+                            ir_printf("time index exceeded\n");
+                            return;
+                        }
                         ir_time[time_index++] = pcycles->mask;
                     }
+                    if (time_index + 1 > USER_DATA_SIZE) {
+                        ir_printf("time index exceeded\n");
+                        return;
+                    }
                     ir_time[time_index++] = pcycles->space;
                     ir_level = IRDA_LEVEL_LOW;
                 }
@@ -263,8 +271,16 @@ static void print_ir_time(t_ir_data *data, UINT8 key_index, UINT16 *ir_time)
                     }
                     else if (ir_level == IRDA_LEVEL_HIGH)
                     {
+                        if (time_index + 1 > USER_DATA_SIZE) {
+                            ir_printf("time index exceeded\n");
+                            return;
+                        }
                         ir_time[time_index++] = pcycles->space;
                     }
+                    if (time_index + 1 > USER_DATA_SIZE) {
+                        ir_printf("time index exceeded\n");
+                        return;
+                    }
                     ir_time[time_index++] = pcycles->mask;
                     ir_level = IRDA_LEVEL_HIGH;
                 }
@@ -278,6 +294,10 @@ static void print_ir_time(t_ir_data *data, UINT8 key_index, UINT16 *ir_time)
                 }
                 else if (ir_level == IRDA_LEVEL_HIGH)
                 {
+                    if (time_index + 1 > USER_DATA_SIZE) {
+                        ir_printf("time index exceeded\n");
+                        return;
+                    }
                     ir_time[time_index++] = pcycles->space;
                 }
                 ir_level = IRDA_LEVEL_LOW;
@@ -291,6 +311,10 @@ static void print_ir_time(t_ir_data *data, UINT8 key_index, UINT16 *ir_time)
                 }
                 else if (ir_level == IRDA_LEVEL_LOW)
                 {
+                    if (time_index + 1 > USER_DATA_SIZE) {
+                        ir_printf("time index exceeded\n");
+                        return;
+                    }
                     ir_time[time_index++] = pcycles->mask;
                 }
                 ir_level = IRDA_LEVEL_HIGH;