RC_Channel: prevent overwrite of memory on high RC_Channel constructor

libraries/RC_Channel/RC_Channel.cpp

@@ -20,11 +20,10 @@ extern const AP_HAL::HAL& hal;
 
 #include "RC_Channel.h"
 
-#define NUM_CHANNELS 8
 /// global array with pointers to all APM RC channels, will be used by AP_Mount
 /// and AP_Camera classes / It points to RC input channels, both APM1 and APM2
 /// only have 8 input channels.
-RC_Channel *RC_Channel::rc_ch[NUM_CHANNELS];
+RC_Channel *RC_Channel::rc_ch[RC_MAX_CHANNELS];
 
 const AP_Param::GroupInfo RC_Channel::var_info[] PROGMEM = {
     // @Param: MIN
@@ -370,3 +369,11 @@ RC_Channel::enable_out()
 {
     hal.rcout->enable_ch(_ch_out);
 }
+
+RC_Channel *RC_Channel::rc_channel(uint8_t i)
+{
+    if (i >= RC_MAX_CHANNELS) {
+        return NULL;
+    }
+    return rc_ch[i];
+}

libraries/RC_Channel/RC_Channel.h

@@ -17,6 +17,8 @@
 #define RC_CHANNEL_TYPE_RANGE       1
 #define RC_CHANNEL_TYPE_ANGLE_RAW   2
 
+#define RC_MAX_CHANNELS 14
+
 /// @class	RC_Channel
 /// @brief	Object managing one RC channel
 class RC_Channel {
@@ -30,8 +32,10 @@ public:
         _high(1),
         _ch_out(ch_out) {
 		AP_Param::setup_object_defaults(this, var_info);
+        if (ch_out < RC_MAX_CHANNELS) {
             rc_ch[ch_out] = this;
         }
+    }
 
     // setup min and max radio values in CLI
     void        update_min_max();
@@ -103,7 +107,7 @@ public:
 
     static const struct AP_Param::GroupInfo         var_info[];
 
-    static RC_Channel *rc_channel(uint8_t i) { return rc_ch[i]; }
+    static RC_Channel *rc_channel(uint8_t i);
 
 private:
     AP_Int8         _reverse;
@@ -115,7 +119,7 @@ private:
     int16_t         _low_out;
     uint8_t         _ch_out;
 
-    static RC_Channel *rc_ch[8];
+    static RC_Channel *rc_ch[RC_MAX_CHANNELS];
 };
 
 // This is ugly, but it fixes poorly architected library