diff --git a/libticalcs/trunk/src/calc_84p.cc b/libticalcs/trunk/src/calc_84p.cc index f452aba0..c377eeb8 100644 --- a/libticalcs/trunk/src/calc_84p.cc +++ b/libticalcs/trunk/src/calc_84p.cc @@ -1762,7 +1762,8 @@ static int get_version (CalcHandle* handle, CalcInfos* infos) if (params[i]->ok) { - ticalcs_strlcpy(infos->product_name, (char *)params[i]->data, sizeof(infos->product_name)); + const uint32_t maxsize = params[i]->size < sizeof(infos->product_name) ? params[i]->size + 1 : sizeof(infos->product_name); + ticalcs_strlcpy(infos->product_name, (char *)params[i]->data, maxsize); infos_mask |= INFOS_PRODUCT_NAME; } i++; diff --git a/libticalcs/trunk/src/calc_89t.cc b/libticalcs/trunk/src/calc_89t.cc index 4a56aa14..e3e3a479 100644 --- a/libticalcs/trunk/src/calc_89t.cc +++ b/libticalcs/trunk/src/calc_89t.cc @@ -1197,7 +1197,8 @@ static int get_version (CalcHandle* handle, CalcInfos* infos) if (params1[i]->ok) { - ticalcs_strlcpy(infos->product_name, (char *)params1[i]->data, sizeof(infos->product_name)); + const uint32_t maxsize = params1[i]->size < sizeof(infos->product_name) ? params1[i]->size + 1 : sizeof(infos->product_name); + ticalcs_strlcpy(infos->product_name, (char *)params1[i]->data, maxsize); infos_mask |= INFOS_PRODUCT_NAME; } i++; diff --git a/libticalcs/trunk/src/calc_nsp.cc b/libticalcs/trunk/src/calc_nsp.cc index 8f20d9b1..73f36877 100644 --- a/libticalcs/trunk/src/calc_nsp.cc +++ b/libticalcs/trunk/src/calc_nsp.cc @@ -513,18 +513,26 @@ static int get_memfree (CalcHandle* handle, uint32_t* ram, uint32_t* flash) ret = nsp_cmd_r_dev_infos(handle, &cmd, &size, &data); if (!ret) { - *flash = ( (((uint32_t)data[4]) << 24) - | (((uint32_t)data[5]) << 16) - | (((uint32_t)data[6]) << 8) - | (((uint32_t)data[7]) )); - - *ram = ( (((uint32_t)data[20]) << 24) - | (((uint32_t)data[21]) << 16) - | (((uint32_t)data[22]) << 8) - | (((uint32_t)data[23]) )); + if (size >= 24) + { + *flash = ( (((uint32_t)data[4]) << 24) + | (((uint32_t)data[5]) << 16) + | (((uint32_t)data[6]) << 8) + | (((uint32_t)data[7]) )); + + *ram = ( (((uint32_t)data[20]) << 24) + | (((uint32_t)data[21]) << 16) + | (((uint32_t)data[22]) << 8) + | (((uint32_t)data[23]) )); + } + else + { + ret = ERR_INVALID_PACKET; + *flash = 0; + *ram = 0; + } g_free(data); - } } @@ -747,8 +755,16 @@ static int recv_idlist (CalcHandle* handle, uint8_t* id) ret = nsp_cmd_r_dev_infos(handle, &cmd, &size, &data); if (!ret) { - strncpy((char *)id, (char*)(data + 82), 28); - id[28] = 0; + if (size >= 110) + { + strncpy((char *)id, (char*)(data + 82), 28); + id[28] = 0; + } + else + { + ret = ERR_INVALID_PACKET; + id[0] = 0; + } g_free(data); } } @@ -906,7 +922,7 @@ static int get_version (CalcHandle* handle, CalcInfos* infos) break; } - ticalcs_strlcpy(infos->product_name, (char *)data, sizeof(infos->product_name)); + ticalcs_strlcpy(infos->product_name, (char *)data, size < sizeof(infos->product_name) ? size + 1 : sizeof(infos->product_name)); infos_mask = INFOS_PRODUCT_NAME; g_free(data);