From bf0a04c036bc0933ff3feebf3198dd5a9197bdf3 Mon Sep 17 00:00:00 2001
From: lbgos <285507185+lbgos@users.noreply.github.com>
Date: Tue, 13 Oct 2026 00:02:18 +0300
Subject: [PATCH] constellation: fail closed when a model exceeds
 MAX_OBJECT_LEDS

project_led_points() and project_bounding_points() write into
caller stack arrays sized MAX_OBJECT_LEDS (64) but looped over the
model's uint8_t counts unchecked. Reject oversized models instead
of overflowing the stack.
---
 src/xrt/tracking/constellation/internal/pose_metrics.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/xrt/tracking/constellation/internal/pose_metrics.c b/src/xrt/tracking/constellation/internal/pose_metrics.c
index 5960907f2..f2c79625e 100644
--- a/src/xrt/tracking/constellation/internal/pose_metrics.c
+++ b/src/xrt/tracking/constellation/internal/pose_metrics.c
@@ -141,6 +141,10 @@ project_led_points(struct t_constellation_led_model *led_model,
                    struct xrt_vec3 *out_positions,
                    struct xrt_vec2 *out_points)
 {
+	/* Callers pass MAX_OBJECT_LEDS-sized stack arrays; fail closed. */
+	if (led_model->num_leds > MAX_OBJECT_LEDS) {
+		return false;
+	}
 	for (int i = 0; i < led_model->num_leds; i++) {
 		struct xrt_vec3 *tmp = out_positions + i;
 		math_pose_transform_point(pose, &led_model->leds[i].pos, tmp);
@@ -270,6 +274,10 @@ project_bounding_points(struct t_constellation_led_model *led_model,
                         struct xrt_vec3 *out_positions,
                         struct xrt_vec2 *out_points)
 {
+	/* Callers pass MAX_OBJECT_LEDS-sized stack arrays; fail closed. */
+	if (led_model->num_bounding_points > MAX_OBJECT_LEDS) {
+		return false;
+	}
 	for (int i = 0; i < led_model->num_bounding_points; i++) {
 		struct xrt_vec3 *tmp = out_positions + i;
 		math_pose_transform_point(P_cam_obj, &led_model->bounding_points[i].pos, tmp);