Add size parameter to expand_name()

3 files changed, 7 insertions, 5 deletions

diff --git a/hcid/lib.c b/hcid/lib.c
index 5fb4b5f2..7edc46a6 100644
--- a/hcid/lib.c
+++ b/hcid/lib.c
@@ -53,7 +53,7 @@ volatile sig_atomic_t __io_canceled;
  * Device name expansion 
  * 	%d - device id
  */
-char *expand_name(char *dst, char *str, int dev_id)
+char *expand_name(char *dst, int size, char *str, int dev_id)
 {
 	register int sp, np, olen;
 	char *opt, buf[10];
@@ -62,7 +62,7 @@ char *expand_name(char *dst, char *str, int dev_id)
 		return NULL;
 
 	sp = np = 0;
-	while (str[sp]) {
+	while (np < size - 1 && str[sp]) {
 		switch (str[sp]) {
 		case '%':
 			opt = NULL;
@@ -88,7 +88,8 @@ char *expand_name(char *dst, char *str, int dev_id)
 			if (opt) {
 				/* substitute */
 				olen = strlen(opt);
-				memcpy(dst + np, opt, olen);
+				if (np + olen < size - 1)
+					memcpy(dst + np, opt, olen);
 				np += olen;
 			}
 			sp += 2;
diff --git a/hcid/lib.h b/hcid/lib.h
index 7091fb0d..8043fbc3 100644
--- a/hcid/lib.h
+++ b/hcid/lib.h
@@ -30,7 +30,7 @@
 
 #include <errno.h>
 
-char *expand_name(char *dst, char *str, int dev_id);
+char *expand_name(char *dst, int size, char *str, int dev_id);
 
 char *get_host_name(void);
 
diff --git a/hcid/main.c b/hcid/main.c
index be523a19..5763798c 100644
--- a/hcid/main.c
+++ b/hcid/main.c
@@ -227,7 +227,8 @@ static void configure_device(int hdev)
 	/* Set device name */
 	if (device_opts->name) {
 		change_local_name_cp cp;
-		expand_name(cp.name, device_opts->name, hdev);
+		memset(cp.name, 0, sizeof(cp.name));
+		expand_name(cp.name, sizeof(cp.name), device_opts->name, hdev);
 
 		hci_send_cmd(s, OGF_HOST_CTL, OCF_CHANGE_LOCAL_NAME,
 			CHANGE_LOCAL_NAME_CP_SIZE, (void *) &cp);