From 849810153b11bd836fbd3b62950e31ade981e75e Mon Sep 17 00:00:00 2001
From: Andrew Kay <git@ajk.me>
Date: Mon, 23 Mar 2020 21:31:51 -0500
Subject: [PATCH] Fix firmware data expansion bug

---
 interface1/firmware/firmware.ino | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/interface1/firmware/firmware.ino b/interface1/firmware/firmware.ino
index 6c89883..9ca5dab 100644
--- a/interface1/firmware/firmware.ino
+++ b/interface1/firmware/firmware.ino
@@ -35,13 +35,13 @@ void handleTransmitReceiveCommand(uint8_t *buffer, int bufferCount) {
     sendErrorMessage(ERROR_INVALID_MESSAGE);
     return;
   }
-  
-  uint16_t transmitRepeatCount = ((buffer[0] << 8) | buffer[1]) & 0x7fff;
-  uint16_t transmitRepeatOffset = buffer[0] >> 7;
 
   uint16_t *transmitBuffer = (uint16_t *) (buffer + 2);
   uint16_t transmitBufferCount = (bufferCount - 6) / 2;
 
+  uint16_t transmitRepeatCount = ((buffer[0] << 8) | buffer[1]) & 0x7fff;
+  uint16_t transmitRepeatOffset = buffer[0] >> 7;
+
   uint16_t receiveBufferSize = (buffer[bufferCount - 4] << 8) | buffer[bufferCount - 3];
   uint16_t receiveTimeout = (buffer[bufferCount - 2] << 8) | buffer[bufferCount - 1];
 
@@ -54,12 +54,15 @@ void handleTransmitReceiveCommand(uint8_t *buffer, int bufferCount) {
   if (transmitRepeatCount > 1) {
     uint8_t *source = ((uint8_t *) transmitBuffer) + (transmitRepeatOffset * 2);
     uint8_t *destination = ((uint8_t *) transmitBuffer) + (transmitBufferCount * 2);
-    size_t length = (transmitBufferCount - transmitRepeatOffset) * 2;
+
+    uint16_t sourceCount = transmitBufferCount - transmitRepeatOffset;
+
+    size_t length = sourceCount * 2;
 
     for (int index = 1; index < transmitRepeatCount; index++) {
       memcpy(destination, source, length);
 
-      transmitBufferCount += (transmitBufferCount - transmitRepeatOffset);
+      transmitBufferCount += sourceCount;
 
       destination += length;
     }