[nullrouten0]

What changes
The NMEA buffer gets 16 extra zero bytes after its 100. The parser is still told the length is 100. 7 lines added in MicroNMEALocationProvider.h.

Why
MicroNMEA 2.0.6 skips a fixed number of characters in some fields. On a malformed sentence whose checksum still passes, it can read a few bytes past the end of the buffer, into the members that follow it. It only reads, it never writes. With the zero tail those reads hit NUL bytes and the parser stops.

Found in a security review of the GPS code. Low severity, but a bad or spoofed GPS sentence can make the parser use bytes that are not part of the sentence. This was the first part of #3624, as you asked, without the test bench. I checked that #3753 did not change the buffer, so the problem is still there.

What I checked

• Fuzzed MicroNMEA under AddressSanitizer: 3 runs of 300,000 random sentences, 100-byte buffer plus a zeroed tail. With no tail: 15 reports. 4-byte tail: 3. 8-byte tail or more: 0. 16 gives a 2x margin.
• Provider with this change, 2 runs of 200,000 fuzzed inputs: same counters as unchanged dev.
• Built Heltec_t114_repeater (nRF52): builds, 410 KB flash.

Not checked

• No automated test: dev has no GPS test setup. The fuzz harness is available if you want it as a separate PR.
• No hardware test. Only the one board above was built.
• The fuzz ran on MicroNMEA by itself, not through the provider: ASan cannot see reads inside one object.

🤖 Generated with Claude Code

[fdlamotte]

Thanks for the addition !