AvareX (and Avare) crash from malformed ADSB packets

[Andrew Sarangan]

I just found that if you send invalid traffic or weather data packets, AvareX (and Avare) will crash. Data packets are framed with 0x7E at the start and end, but if the data itself contains 7E, then it needs to be escaped with 0x7D.  If I fail to insert that escape character, Avare crashes while trying to interpret that packet.  Ideally, the app should ignore malformed packets rather than crash. I can send a crash report if anyone is interested.

[Brad Walker]

I would be interested in a "crash report"..

-brad w.

On Mon, Apr 27, 2026 at 1:15 PM Andrew Sarangan <asar...@gmail.com> wrote:

I just found that if you send invalid traffic or weather data packets, AvareX (and Avare) will crash. Data packets are framed with 0x7E at the start and end, but if the data itself contains 7E, then it needs to be escaped with 0x7D.  If I fail to insert that escape character, Avare crashes while trying to interpret that packet.  Ideally, the app should ignore malformed packets rather than crash. I can send a crash report if anyone is interested.

--
You received this message because you are subscribed to the Google Groups "Apps4Av Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to apps4av-foru...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/apps4av-forum/CAMtwq8-SPPLEgXqKXwzdyA8rPwmqgtYDpYLGpKSZpAWC_STZjw%40mail.gmail.com.

[Mike]

Hi, can you post a few of the actual frames here please?

[Andrew Sarangan]

These are the uplink weather frames that were crashing Avare and AvareX. It was an out of memory error from the METAR parser. It was a repeatable crash - I checked it half a dozen times.  However, I uninstalled and reinstalled Avare and AvareX, and they are not crashing any more. I am not sure what to make of that. I suspect it could have been a collision between a METAR that was already downloaded from the internet and my ADSB weather packet. I am not able to reproduce it any more. 

7E0700000037C5EF891060B7F02C00067453503455014A02C404E832DB2C35CDA8015543E0C37C30E47C762D4830D705B1C70831C1336008B3B0CF380F583C34D20C77BF0E6081E705073C30D2048D2E004FCA04CC431DB3814C31DB7C30E74835D70C70F5E7402D00067445405011A02C250C832DB1DF2C1A832DB1E2FCB7C78831C70C382D4810D933601855F2D7079C146372DF0C30C20C72C30E0B5204364CD8022CECB5C1E70518DCB7C73C30831D30C731F2C4B5204364CD8022CECB5C3D79D02D80067453503455014A02C7147832DB2C35CDA832D30C721F1D8B520C704CD806157C33C2008B3B0E708022CEC72C2008B3B2C3081EC74BCDC39801CB9DF681234B8013F2813310C37E20589487060530C73E71C39D20D75C30C3D79D2E00067453503455014A02C5459832DB2C35CDA8015543E0C35C30DCB520C704CD80F583C33D20CB0BF1CE0072E79DE048D2E004FCA081E705481170D02D34175CE04CC431D71810C30C30836C30C30814C32C30C31CF3835CF0C36F5E7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000793B7E

7E070000003916598895A4B6A0248006744F303455014A02D9387832DB1E75C5A816482C342D4831C133604C3530CF58022CECB5C20C76BF0DE0073C31C2048D2E004FCA04CC431E7682079C154C31D76C30DB7824F5E740248006744F303455014A02D350C832DB1E75C5A831CB0C702D4831C133601855F1CB08022CECB5C20CB5BF1C60072E78E2048D2E004FCA04CC431C7182079C154C32D70C31C36824F5E740258006744F603455014A02C25C9832DB1E75D1A830C70C391F1D8B520C704CD8130D4C32E203D60F0D38831CEFC36801CF0C7081234B8013F282079C153310C79CE0530C73CF0C36C6093D79D0278006744F503455014A02C4517832DB1E75CDA831C30C391F1DCB520C37C16C74C20C704CD806157C32D6008B3B2C30831DAFC37801CF0C7581234B82079C1413F2813310CB1C20530C76C70C36DFD79D2980067452303455014A02D7DF8832DB2C33D5A8015543E0C35C30E07C752D4830C705B0E70831C133604C3530CB78130D4C33E203D60F0D3682079C171DAFC38801CF0C3581234B8013F1814C31DB2C30E30F5E74000000000000000000000000000000000000000000000000000000000000001A2A7E

Crash message: 

21:21:28.049 19809-20055 com.ds.avare            com.ds.avare                         W  Throwing OutOfMemoryError "Failed to allocate a 55380616 byte allocation with 25165824 free bytes and 43MB until OOM, target footprint 583111744, growth limit 603979776" (VmSize 42726756 kB)2026-04-27 21:21:28.051 19809-20055 AndroidRuntime          com.ds.avare                         E  FATAL EXCEPTION: Thread-9Process: com.ds.avare, PID: 19809java.lang.OutOfMemoryError: Failed to allocate a 55380616 byte allocation with 25165824 free bytes and 43MB until OOM, target footprint 583111744, growth limit 603979776at java.util.Arrays.copyOf(Arrays.java:3754)at java.util.Arrays.copyOf(Arrays.java:3723)at java.util.ArrayList.grow(ArrayList.java:244)at java.util.ArrayList.grow(ArrayList.java:251)at java.util.ArrayList.add(ArrayList.java:490)at java.util.ArrayList.add(ArrayList.java:503)at net.sf.jweather.metar.Metar.addSkyCondition(Metar.java:670)at net.sf.jweather.metar.MetarParser.parseData(MetarParser.java:762)at net.sf.jweather.metar.MetarParser.parse(MetarParser.java:123)at com.ds.avare.weather.MetarFlightCategory.getFlightCategory(MetarFlightCategory.java:49)at com.ds.avare.connections.BufferProcessor.decode(BufferProcessor.java:398)at com.ds.avare.connections.WifiConnection$1.callback(WifiConnection.java:104)at com.ds.avare.connections.Connection$1.run(Connection.java:181)2026-04-27 21:21:28.069 19809-19827 TransportR...EventStore com.ds.avare                         D  Storing event with priority=HIGHEST, name=FIREBASE_CRASHLYTICS_REPORT for destination cct2026-04-27 21:21:28.072 19809-19827 TransportR...oScheduler com.ds.avare                         D  Scheduling upload for context TransportContext(cct, HIGHEST, MSRodHRwczovL2NyYXNobHl0aWNzcmVwb3J0cy1wYS5nb29nbGVhcGlzLmNvbS92MS9maXJlbG9nL2xlZ2FjeS9iYXRjaGxvZ1xBSXphU3lCcnBTWVQ0RkZMMDlyZUhKaTZIOUZZZGVpU25VVE92Mk0=) with jobId=593505931 in 1000ms(Backend next call timestamp 1777338931591). Attempt 12026-04-27 

--
You received this message because you are subscribed to the Google Groups "Apps4Av Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to apps4av-foru...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/apps4av-forum/89a4436e-11cc-462d-91af-37ef0f259e45n%40googlegroups.com.

[Mike]

Thanks Andrew. AFAIKS, those are malformed frames that should not be processed by the ADSB Receiver used. E.g. Avare ADSB will discard them. Which app or device converted the frame to GDL90 and sent it to Avare/AvareX?

However, there may still be a memory issue that should be addressed in the weather parser.

[Bruce B]

Also, Andrew, to clarify a bit (although I am sure you looked) at least with the Stratux GDL90 frame generator, both 0x7D and 0x7E are escaped with 0x7D, which makes sense.  But they are also XORed with 0x20 before being appended.  So I think your 0x7E would get appended as 0x5E 0x7D.

[Andrew Sarangan]

Sorry, I should have explained, the starting and trailing 7E in the packet will not be escaped during transmission, but only the interior 7E or 7D will be escaped by XORing with 20, as you correctly pointed out. I believe I am doing that correctly when I am sending the packets. 

I should have also stated that these packets are not malformed, at least they don't look like that to me. But it was still crashing Avare and AvareX because it was sending the METAR parser into an infinite loop. But hundreds of other similar looking packets were going through without an issue. I could not find what was unique about these packets. Unfortunately, I am not able to reproduce that crash anymore after reinstalling the app, so I am not able to investigate any further. 

There is a separate crash that was coming from malformed packets. I tried sending malformed traffic packets by not escaping the interior 7E or 7D (accidentally on my part), which was causing that crash. After properly escaping those characters, that stopped the crash. However, I was confused Avare was not rejecting those packets instead of choking on them.

To view this discussion visit https://groups.google.com/d/msgid/apps4av-forum/0d44ee7f-99a0-41c0-a96f-247faad79d1fn%40googlegroups.com.

[Bruce B]

You were clear in the original post.  I was just going off the stratux code to see how they did it.

In your first sample, I see a 0x7E.  Going by the XOR and escape, am I right in saying there should never be a 0x7E embedded in the payload (leaving out the terminators)?  As 0x7D is the escape character, it should also be escaped (and XORed) if it is an actual part of the payload.  If 0x7D is seen, it should be followed by 0x5D or 0x5E since it indicates it is escaping something.

In your first sample, I see the 0x7E and its followed by the 0x20, which looks to be a mistake?

[Andrew Sarangan]

Never mind, the crash is back, on those exact same packets I posted. I am suspecting some conflict between internet-downloaded weather and the ADSB packets. Is there a way to purge the stored weather from the internet without having to clear all user data (which will then require downloading the database and charts)?

To view this discussion visit https://groups.google.com/d/msgid/apps4av-forum/691b9e0c-2baa-420e-b65c-45a1d6bdedf9n%40googlegroups.com.

[Apps4av Support]

Which app is crashing now and what version? 

Regards,

Apps For Aviators Support,

We encourage users to use the Forum for all questions. Any updates to the forum will help other users, who might have similar questions.
Forum: https://groups.google.com/forum/#!forum/apps4av-forum

To view this discussion visit https://groups.google.com/d/msgid/apps4av-forum/CAMtwq89WfS-fhTrH%3DtkyVtYSMEGZkvLdKzPd3UUT16ECXirX1Q%40mail.gmail.com.

[Andrew Sarangan]

Avare version 11.0.7

[Apps4av Support]

The metar, taf, winds issues have been fixed in X version 102.

Regards,

Apps For Aviators Support,

We encourage users to use the Forum for all questions. Any updates to the forum will help other users, who might have similar questions.
Forum: https://groups.google.com/forum/#!forum/apps4av-forum

To view this discussion visit https://groups.google.com/d/msgid/apps4av-forum/691b9e0c-2baa-420e-b65c-45a1d6bdedf9n%40googlegroups.com.