@@ -378,9 +378,8 @@ mraa_iio_detect()
378378 // remove any trailing CR/LF symbols
379379 name [strcspn (name , "\r\n" )] = '\0' ;
380380 len = strlen (name );
381- // use strndup
382381 device -> name = malloc ((sizeof (char ) * len ) + sizeof (char ));
383- strncpy (device -> name , name , len + 1 );
382+ memcpy (device -> name , name , len + 1 );
384383 }
385384 close (fd );
386385 }
@@ -910,7 +909,7 @@ mraa_gpio_lookup(const char* pin_name)
910909 if (!(plat -> pins [i ].capabilities .gpio ))
911910 continue ;
912911
913- if (plat -> pins [i ].name != NULL &&
912+ if (* plat -> pins [i ].name &&
914913 strncmp (pin_name , plat -> pins [i ].name , strlen (plat -> pins [i ].name ) + 1 ) == 0 ) {
915914 return i ;
916915 }
@@ -1158,9 +1157,15 @@ mraa_find_uart_bus_pci(const char* pci_dev_path, char** dev_name)
11581157 return MRAA_ERROR_INVALID_RESOURCE ;
11591158 }
11601159
1161- * dev_name = (char * ) malloc (sizeof (char ) * max_allowable_len );
1160+ size_t len = strlen (namelist [n - 1 ]-> d_name );
1161+ if (len > max_allowable_len )
1162+ if (n <= 0 ) {
1163+ syslog (LOG_ERR , "device name too long: %s" , namelist [n - 1 ]-> d_name );
1164+ return MRAA_ERROR_INVALID_RESOURCE ;
1165+ }
1166+ * dev_name = (char * ) malloc (sizeof (char ) * len + 6 );
11621167
1163- snprintf (* dev_name , max_allowable_len , "/dev/%s" , namelist [n - 1 ]-> d_name );
1168+ snprintf (* dev_name , len + 5 , "/dev/%s" , namelist [n - 1 ]-> d_name );
11641169 while (n -- ) {
11651170 free (namelist [n ]);
11661171 }
@@ -1523,7 +1528,7 @@ mraa_init_io(const char* desc)
15231528 if (length > 255 || length == 0 ) {
15241529 return NULL ;
15251530 }
1526- strncpy (buffer , desc , length );
1531+ strncpy (buffer , desc , sizeof ( buffer ) - 1 );
15271532
15281533 str = buffer ;
15291534 token = strsep (& str , delim );
@@ -1534,7 +1539,7 @@ mraa_init_io(const char* desc)
15341539 syslog (LOG_ERR , "mraa_init_io: An invalid IO type was provided" );
15351540 return NULL ;
15361541 }
1537- strncpy (type , token , length );
1542+ strncpy (type , token , sizeof ( type ) - 1 );
15381543 mraa_to_upper (type );
15391544 token = strsep (& str , delim );
15401545 // Check that they've given us more information than just the type
0 commit comments