[PATCH BlueZ v2 02/10] shared/ad: Fix reading past the name that was copied

From: Luiz Augusto von Dentz <[email protected]>

ad_replace_name() copies at most HCI_MAX_NAME_LENGTH bytes of the name
into its buffer, but then hands the full iov_len to strisutf8() and
strtoutf8().

The advertising data is up to 255 bytes, so a complete local name field
can hold 253 of them, and both end up reading 253 bytes out of a 250
byte buffer, 3 of them past its end.

Use the same clamped length throughout.

Assisted-by: Claude:claude-opus-5
---
 src/shared/ad.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/shared/ad.c b/src/shared/ad.c
index b1d1b84611aa..ebee078500c6 100644
--- a/src/shared/ad.c
+++ b/src/shared/ad.c
@@ -276,15 +276,15 @@ static bool ad_replace_uuid128(struct bt_ad *ad, struct iovec *iov)
 static bool ad_replace_name(struct bt_ad *ad, struct iovec *iov)
 {
 	char utf8_name[HCI_MAX_NAME_LENGTH + 2];
+	size_t len = MIN(iov->iov_len, (size_t) HCI_MAX_NAME_LENGTH);
 
 	memset(utf8_name, 0, sizeof(utf8_name));
-	strncpy(utf8_name, (const char *)iov->iov_base,
-			MIN(iov->iov_len, HCI_MAX_NAME_LENGTH));
+	strncpy(utf8_name, (const char *)iov->iov_base, len);
 
-	if (strisutf8(utf8_name, iov->iov_len))
+	if (strisutf8(utf8_name, len))
 		goto done;
 
-	strtoutf8(utf8_name, iov->iov_len);
+	strtoutf8(utf8_name, len);
 
 	/* Remove leading and trailing whitespace characters */
 	strstrip(utf8_name);
-- 
2.54.0