Buffer overflow in ESP32 WiFi drivers and XPlane SITL connector

[THE-Amrit-mahto-05]

Bug report

I found a buffer overflow vulnerability in ArduPilot:

1. ESP32 WiFi drivers:
   • In libraries/AP_HAL_ESP32/WiFiDriver.cpp and WiFiUdpDriver.cpp, strcpy is used to copy SSID and password into fixed-size buffers.
2. SITL XPlane connector:
   • In libraries/SITL/SIM_XPlane.cpp, strcpy is used to copy dataref names into fixed-size buffers.

Using strings longer than the buffer size can cause stack-buffer-overflow and program crash.
I verified this using a minimal test case compiled with AddressSanitizer.

Version
Branch: master
Commit: ed2c343

Platform
[X] All
[X] Copter
[X] Plane
[X] Rover
[X] Submarine

Airframe type
Not applicable (HAL/SITL issue)

Hardware type

• ESP32 (WiFi drivers)
• SITL (XPlane connector)

Logs

Screen.Recording.2025-12-27.at.5.59.25.AM.mov