Bound payload.bytes prints by payload.size

[caveman99]

decoded.payload.bytes is a fixed 233-byte protobuf bytes field and is not
NUL-terminated. A few sites print it with a plain "%s", which reads until it finds a
NUL; a full-length payload with no NUL byte makes that read run off the end of the field.

Fixed to "%.*s" bounded by payload.size, which is the form
SerialModule already uses for the raw write(bytes, size) case a few lines up.

Live sites:

• RangeTestModule.cpp appendFile() - writes received text to the range-test CSV
• SerialModule.cpp - PROTO/TEXTMSG serial output of received messages

The same change is applied to three currently commented-out debug lines
(RangeTestModule x2, Router.cpp compression block) so the pattern stays correct if
they are ever re-enabled; those are not live today.

Swept the tree for every other payload.bytes used as a C string. The rest are already
safe: pb_decode/pb_encode/memcpy with an explicit size, strnlen(payload, 219)
(under the 233-byte field) in MessageStore, a payload.size-bounded alert-scan loop in
MessageRenderer, an explicit clamped length in the InkHUD store path, and a
strncasecmp bounded by a 54-byte local buffer in DropzoneModule. Many call sites
already use the "%.*s" form; this brings the stragglers in line.

No unit test: the two live sites are inline writes to a Stream and to the filesystem, so a
targeted repro needs serial/FS mocking for what is a mechanical format-string bound with no
behavior change for valid input. The coverage env builds with ASan, which guards the
broader decode paths the suite already exercises.

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of received payloads that are not null-terminated or contain binary data.
  • Serial echo and text output now consistently display the recorded payload length.
  • Debug logs and CSV exports now preserve payload content more reliably without relying on null-termination.

[coderabbitai]

📝 Walkthrough

Walkthrough

Payload debug, CSV, echo, and text-mode output now print packet payloads using their explicit sizes rather than relying on null termination.

Changes

Payload output formatting

Layer / File(s)	Summary
Length-aware payload logging and printing src/mesh/Router.cpp, src/modules/RangeTestModule.cpp, src/modules/SerialModule.cpp	Updated payload debug logs, CSV writes, serial echo, and TEXTMSG output to use %.*s with the recorded payload size.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: jp-bennett, thebentern

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: bounding payload.bytes prints by payload.size.
Description check	✅ Passed	The description covers the bug, affected sites, and test rationale; only the template attestation checklist is omitted.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bound-payload-prints

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/modules/RangeTestModule.cpp`:
- Around line 307-311: Update the CSV row-writing sequence around the payload
formatter so rx_rssi remains on the same row as the payload, matching the
header’s column order. Escape every embedded double quote in p.payload before
emitting it, while preserving the existing bounded payload handling, and write
exactly one record terminator only after the RSSI column.

In `@src/modules/SerialModule.cpp`:
- Line 399: Update the self-echo output in SerialModule to use byte-oriented
serialPrint->write with p.payload.bytes and p.payload.size instead of
printf("%.*s"), preserving embedded NUL bytes and matching the default serial
path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d2de6406-e7db-488f-9cd1-68a453226261

📥 Commits

Reviewing files that changed from the base of the PR and between 381f9c1 and 8ab2c68.

📒 Files selected for processing (3)

• src/mesh/Router.cpp
• src/modules/RangeTestModule.cpp
• src/modules/SerialModule.cpp

[github-actions]

⚡ Try this PR in the Web Flasher

Note

Building this pull request… the flash button, badges and supported-board
list will appear here automatically once CI finishes.