From f16e7903891d0af1bb296399c0d767631111c257 Mon Sep 17 00:00:00 2001
From: erikkaashoek <erik@kaashoek.com>
Date: Mon, 9 Nov 2026 12:13:15 +0100
Subject: [PATCH] Fixed a crash when a band frequency went below 0 Hz, e.g.
 SPAN on a new band: the frequency printer wrote past its buffer for values
 from 1 THz (issue #175)

---
 chprintf.c |  7 ++++++-
 ui.c       | 29 +++++++++++------------------
 2 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/chprintf.c b/chprintf.c
index 6bba7fe..4dfcc90 100644
--- a/chprintf.c
+++ b/chprintf.c
@@ -87,6 +87,11 @@ static char *long_to_string_with_divisor(char *p,
 // default prescision = 13
 // g.mmm kkk hhh
 #define MAX_FREQ_PRESCISION 15
+#ifdef TINYSA4
+#define FREQ_DIGITS         23  // any 64 bit value: 20 digits and 3 separators, fits tmpbuf[2*MAX_FILLER + 1]
+#else
+#define FREQ_DIGITS         MAX_FREQ_PRESCISION
+#endif
 #define FREQ_PSET           1
 #define FREQ_NO_SPACE       2
 #define FREQ_PREFIX_SPACE   4
@@ -99,7 +104,7 @@ ulong_freq(char *p, ulong_t freq, uint32_t width, uint32_t precision)
 
   if (/* precision == 0 || */ precision > MAX_FREQ_PRESCISION)
     precision = MAX_FREQ_PRESCISION;
-  char *q = p + MAX_FREQ_PRESCISION;
+  char *q = p + FREQ_DIGITS;  // digits are written backwards from here
   char *b = q;
   // Prefix counter
   uint32_t s = 0;
diff --git a/ui.c b/ui.c
index 9c71f9b..6689c5b 100644
--- a/ui.c
+++ b/ui.c
@@ -5945,7 +5945,7 @@ static void fetch_numeric_target(uint8_t mode)
     plot_printf(uistat.text, sizeof uistat.text, out_format, uistat.freq_value);
     break;
   case KM_BAND_SPAN:
-    uistat.freq_value = abs((long)setting.bands[active_band].end-(long)setting.bands[active_band].start);
+    uistat.freq_value = setting.bands[active_band].end - setting.bands[active_band].start;
 #ifdef TINYSA4
     if (uistat.freq_value > 990000000UL)
       out_format = "%.6Q";
@@ -6233,28 +6233,21 @@ set_numeric_value(void)
 //    BANDs_update();
     break;
   case KM_BAND_CENTER:
+  case KM_BAND_SPAN:
   {
-    freq_t span = abs((long)setting.bands[active_band].end - (long)setting.bands[active_band].start);
-    freq_t center = uistat.freq_value - (setting.frequency_offset - FREQUENCY_SHIFT);
-    setting.bands[active_band].start = center - span/2;
-    setting.bands[active_band].end = center + span/2;
+    band_t *b = &setting.bands[active_band];
+    freq_t center = (b->end + b->start)/2;
+    freq_t span = b->end - b->start;            // START and STOP keep start <= end
+    if (keypad_mode == KM_BAND_CENTER)
+      center = uistat.freq_value - (setting.frequency_offset - FREQUENCY_SHIFT);
+    else
+      span = uistat.freq_value;
+    b->start = center > span/2 ? center - span/2 : 0;   // unsigned, a new band (0..0) with a span went "below 0 Hz"
+    b->end = b->start + span;
     update_frequencies();
     dirty = true;
     update_grid();
   }
-//    BANDs_update();
-    break;
-  case KM_BAND_SPAN:
-    {
-    freq_t span = uistat.freq_value;
-    freq_t center =  (setting.bands[active_band].end + setting.bands[active_band].start)/2;
-    setting.bands[active_band].start = center - span/2;
-    setting.bands[active_band].end = center + span/2;
-    update_frequencies();
-    dirty = true;
-    update_grid();
-//    BANDs_update();
-    }
     break;
   case KM_BAND_LEVEL:
     setting.bands[active_band].level = to_dBm(uistat.value);