fix: Use bounded string functions to prevent over-read on non-null-terminated strings (CWE-126)

Replace strlen/strcmp with strnlen/strncmp across cbv2g_wrapper to
address Codacy static analysis findings. No behavioral change for
valid null-terminated input.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Nancy Zhang <nancy.zhang@enteligent.com>

Author: Nancy Zhang

iso15118/shared/cbv2g_wrapper/src/apphand_converter.c

@@ -192,7 +192,7 @@ static int json_to_apphand_req(cJSON* json, struct appHand_supportedAppProtocolR
 
         /* ProtocolNamespace */
         const char* ns = json_get_string(item, "ProtocolNamespace");
-        size_t ns_len = strlen(ns);
+        size_t ns_len = strnlen(ns, appHand_ProtocolNamespace_CHARACTER_SIZE);
         if (ns_len >= appHand_ProtocolNamespace_CHARACTER_SIZE) {
             ns_len = appHand_ProtocolNamespace_CHARACTER_SIZE - 1;
         }
@@ -220,11 +220,14 @@ static int json_to_apphand_res(cJSON* json, struct appHand_supportedAppProtocolR
 
     /* ResponseCode */
     const char* response_code = json_get_string(json, "ResponseCode");
-    if (strcmp(response_code, "OK_SuccessfulNegotiation") == 0) {
+    if (strncmp(response_code, "OK_SuccessfulNegotiation",
+                sizeof("OK_SuccessfulNegotiation")) == 0) {
         res->ResponseCode = appHand_responseCodeType_OK_SuccessfulNegotiation;
-    } else if (strcmp(response_code, "OK_SuccessfulNegotiationWithMinorDeviation") == 0) {
+    } else if (strncmp(response_code, "OK_SuccessfulNegotiationWithMinorDeviation",
+                       sizeof("OK_SuccessfulNegotiationWithMinorDeviation")) == 0) {
         res->ResponseCode = appHand_responseCodeType_OK_SuccessfulNegotiationWithMinorDeviation;
-    } else if (strcmp(response_code, "Failed_NoNegotiation") == 0) {
+    } else if (strncmp(response_code, "Failed_NoNegotiation",
+                       sizeof("Failed_NoNegotiation")) == 0) {
         res->ResponseCode = appHand_responseCodeType_Failed_NoNegotiation;
     } else {
         /* Try as integer */

iso15118/shared/cbv2g_wrapper/src/cbv2g_json_wrapper.c

@@ -51,32 +51,32 @@ static protocol_t get_protocol(const char* namespace) {
         return PROTOCOL_UNKNOWN;
     }
 
-    if (strcmp(namespace, NS_SAP) == 0) {
+    if (strncmp(namespace, NS_SAP, sizeof(NS_SAP)) == 0) {
         return PROTOCOL_SAP;
     }
-    if (strcmp(namespace, NS_DIN_MSG_DEF) == 0) {
+    if (strncmp(namespace, NS_DIN_MSG_DEF, sizeof(NS_DIN_MSG_DEF)) == 0) {
         return PROTOCOL_DIN;
     }
-    if (strcmp(namespace, NS_ISO_V2_MSG_DEF) == 0) {
+    if (strncmp(namespace, NS_ISO_V2_MSG_DEF, sizeof(NS_ISO_V2_MSG_DEF)) == 0) {
         return PROTOCOL_ISO2;
     }
-    if (strcmp(namespace, NS_ISO_V20_COMMON_MSG) == 0) {
+    if (strncmp(namespace, NS_ISO_V20_COMMON_MSG, sizeof(NS_ISO_V20_COMMON_MSG)) == 0) {
         return PROTOCOL_ISO20_COMMON;
     }
-    if (strcmp(namespace, NS_ISO_V20_AC) == 0) {
+    if (strncmp(namespace, NS_ISO_V20_AC, sizeof(NS_ISO_V20_AC)) == 0) {
         return PROTOCOL_ISO20_AC;
     }
-    if (strcmp(namespace, NS_ISO_V20_DC) == 0) {
+    if (strncmp(namespace, NS_ISO_V20_DC, sizeof(NS_ISO_V20_DC)) == 0) {
         return PROTOCOL_ISO20_DC;
     }
-    if (strcmp(namespace, NS_ISO_V20_WPT) == 0) {
+    if (strncmp(namespace, NS_ISO_V20_WPT, sizeof(NS_ISO_V20_WPT)) == 0) {
         return PROTOCOL_ISO20_WPT;
     }
-    if (strcmp(namespace, NS_ISO_V20_ACDP) == 0) {
+    if (strncmp(namespace, NS_ISO_V20_ACDP, sizeof(NS_ISO_V20_ACDP)) == 0) {
         return PROTOCOL_ISO20_ACDP;
     }
     /* Check for ISO20 base prefix */
-    if (strncmp(namespace, NS_ISO_V20_BASE, strlen(NS_ISO_V20_BASE)) == 0) {
+    if (strncmp(namespace, NS_ISO_V20_BASE, sizeof(NS_ISO_V20_BASE) - 1) == 0) {
         return PROTOCOL_ISO20_COMMON;
     }
 

iso15118/shared/cbv2g_wrapper/src/json_utils.c

@@ -180,7 +180,9 @@ int json_has_key(cJSON* obj, const char* key) {
 size_t json_get_bytes(cJSON* obj, const char* key, uint8_t* output, size_t output_size) {
     cJSON* item = cJSON_GetObjectItemCaseSensitive(obj, key);
     if (item && cJSON_IsString(item)) {
-        return base64_decode(item->valuestring, strlen(item->valuestring), output, output_size);
+        size_t max_b64_len = ((output_size + 2) / 3) * 4;
+        size_t vs_len = strnlen(item->valuestring, max_b64_len);
+        return base64_decode(item->valuestring, vs_len, output, output_size);
     }
     return 0;
 }