From 36ba5eb7410308d7b619b9b67d6695e97a45c0be Mon Sep 17 00:00:00 2001
From: Lorenz Meier <lorenz@px4.io>
Date: Wed, 4 Jan 2017 10:14:25 +0100
Subject: [PATCH] Control lib: Fix string handling corner cases

strncpy() does not enforce NUL-termination, but snprintf() does. So we need to ensure all strings are terminated. Another issue was the use of the wrong length parameter for these functions, resulting in the limiting arguments not being applied to the right length.
---
 src/lib/controllib/block/Block.cpp      | 8 ++++++--
 src/lib/controllib/block/BlockParam.cpp | 4 ++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/lib/controllib/block/Block.cpp b/src/lib/controllib/block/Block.cpp
index 9e27b4321a..dad96c3096 100644
--- a/src/lib/controllib/block/Block.cpp
+++ b/src/lib/controllib/block/Block.cpp
@@ -66,16 +66,20 @@ void Block::getName(char *buf, size_t n)
 {
 	if (getParent() == NULL) {
 		strncpy(buf, _name, n);
+		// ensure string is terminated
+		buf[n - 1] = '\0';
 
 	} else {
 		char parentName[blockNameLengthMax];
 		getParent()->getName(parentName, n);
 
 		if (!strcmp(_name, "")) {
-			strncpy(buf, parentName, blockNameLengthMax);
+			strncpy(buf, parentName, n);
+			// ensure string is terminated
+			buf[n - 1] = '\0';
 
 		} else {
-			snprintf(buf, blockNameLengthMax, "%s_%s", parentName, _name);
+			snprintf(buf, n, "%s_%s", parentName, _name);
 		}
 	}
 }
diff --git a/src/lib/controllib/block/BlockParam.cpp b/src/lib/controllib/block/BlockParam.cpp
index 5b3ad134e6..d0c4e417d5 100644
--- a/src/lib/controllib/block/BlockParam.cpp
+++ b/src/lib/controllib/block/BlockParam.cpp
@@ -62,12 +62,16 @@ BlockParamBase::BlockParamBase(Block *parent, const char *name, bool parent_pref
 
 		if (!strcmp(name, "")) {
 			strncpy(fullname, parentName, blockNameLengthMax);
+			// ensure string is terminated
+			fullname[sizeof(fullname) - 1] = '\0';
 
 		} else if (parent_prefix) {
 			snprintf(fullname, blockNameLengthMax, "%s_%s", parentName, name);
 
 		} else {
 			strncpy(fullname, name, blockNameLengthMax);
+			// ensure string is terminated
+			fullname[sizeof(fullname) - 1] = '\0';
 		}
 
 		parent->getParams().add(this);