fix: the crsf receiver packet handler copies rf-rece... in crsf.c

[orbisai0security]

Summary

Fix critical severity security issue in src/rx/crsf.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/rx/crsf.c:91

Description: The CRSF receiver packet handler copies RF-received payload data into fixed-size firmware buffers using memcpy without first verifying that the payload size field does not exceed the destination buffer capacity. In src/rx/crsf.c:91, memcpy(buf + 5, payload, size) uses the attacker-controlled size field directly. In src/rx/unified_crsf.c:284, memcpy(msp_tx_buffer, data, len) similarly uses an unchecked len value. An attacker transmitting a crafted CRSF packet with an oversized size field can overflow the destination buffer, corrupting adjacent memory on the embedded microcontroller.

Changes

• src/rx/crsf.c
• src/rx/unified_crsf.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security