Adjudicate the Antares Detector CWE-190 report against SpeProtocol's display-frame parsing

An automated scan ("Antares Detector") posted on #5541 (2026-09-10) naming src/core/SpeProtocol.cpp / src/gui/SpeLcdWidget.h as candidate CWE-190 — "unvalidated buffer growth in the display-frame length handling". Filing this so the report gets an explicit ruling instead of living only as a comment on a closing issue (raised by @NF0T in the #5542 review round).

My own analysis as the code's author, for the record — I believe the report is mistaken, but it deserves adjudication by someone who didn't write the code:

• readDisplayCandidate accumulates into a QByteArray bounded by Lcd::kFrameLength (371) logical bytes — at most 742 raw bytes consumed in the telnet-escaped reading — and reserve()s that fixed amount up front. No length field read from the wire ever sizes an allocation: the 6A 01 bytes are validated against the expected constant, not used as a size.
• The CNT frame path caps at kMaxDataLength before any allocation.
• FrameParser::m_buf growth is bounded per feed cycle: every loop iteration either consumes a complete frame, resyncs forward, clears the buffer when no sync byte remains, or returns waiting for a bounded remainder (≤742 bytes for a display candidate, ≤kMaxDataLength+6 for a CNT frame).
• SpeLcdWidget.h holds fixed-size chars[8][40] / inverse[8][40] arrays filled by Lcd::decode, which rejects any buffer that is not exactly the pinned frame length before touching them.

If adjudication confirms this reading, this closes with no code change; if it finds a path I missed, it becomes the repro for a fix. Protocol-fuzzing FrameParser::feed with random chunk splits would settle it empirically and might be worth having regardless.

73 de Miguel, EC5W

Start with src/core/SpeProtocol.cpp, especially readDisplayCandidate and FrameParser::feed, then inspect the fixed-size arrays and decode validation in src/gui/SpeLcdWidget.h. Compare every allocation and buffer-growth path with the stated bounds; protocol-fuzzing FrameParser::feed with random chunk splits may help. Done means issuing an explicit ruling, with a repro and fix only if an unbounded path is found.