From: Arnie Reynoso <arnier@ti.com>
Date: Thu, 13 Mar 2014 21:08:00 +0000 (-0700)
Subject: BIOS: NameServerRemote must copy names with 1 char less than max
X-Git-Tag: 3.22.00.01_eng~4
X-Git-Url: https://git.ti.com/gitweb?p=ipc%2Fipcdev.git;a=commitdiff_plain;h=fb906e405a39754a3b39a84eed81c0084cbbed65

BIOS: NameServerRemote must copy names with 1 char less than max

The strncpy length must be max number of characters - 1 bytes. The last
character will be the null termination thus shouldn't be copied. This
fix addresses a Coverity buffer overrun error.
---

diff --git a/packages/ti/ipc/namesrv/NameServerRemoteRpmsg.c b/packages/ti/ipc/namesrv/NameServerRemoteRpmsg.c
index 9ec6839..f412927 100644
--- a/packages/ti/ipc/namesrv/NameServerRemoteRpmsg.c
+++ b/packages/ti/ipc/namesrv/NameServerRemoteRpmsg.c
@@ -184,12 +184,12 @@ Int NameServerRemoteRpmsg_get(NameServerRemoteRpmsg_Object *obj,
 
     len = strlen(instanceName);
     Assert_isTrue(len < MAXNAMEINCHAR, NameServerRemoteRpmsg_A_nameIsTooLong);
-    strncpy((Char *)msg.instanceName, instanceName, MAXNAMEINCHAR);
+    strncpy((Char *)msg.instanceName, instanceName, MAXNAMEINCHAR - 1);
     ((Char *)msg.instanceName)[MAXNAMEINCHAR - 1] = '\0';
 
     len = strlen(name);
     Assert_isTrue(len < MAXNAMEINCHAR, NameServerRemoteRpmsg_A_nameIsTooLong);
-    strncpy((Char *)msg.name, name, MAXNAMEINCHAR);
+    strncpy((Char *)msg.name, name, MAXNAMEINCHAR - 1);
     ((Char *)msg.name)[MAXNAMEINCHAR - 1] = '\0';
 
     Log_print3(Diags_INFO, FXNN": Requesting from procId %d, %s:%s...\n",