[PATCH 7/7] alfred: gpsd: handle empty or not 0-terminated TPV

[Sven Eckelmann]

gpsd_read_answer() printed the received TPV data with %s without verifying
that the announced tpv_len bytes actually contain a terminating null byte.
A record without termination made printf() read beyond the received data
until the next null byte in memory.

Ensure printf is only outputting the content of the buffer. A record with
tpv_len == 0 has no TPV bytes at all and must not be printed either.

Fixes: 2b901d69d8fb ("alfred: Add support for passing location information over 
alfred.")
Signed-off-by: Sven Eckelmann <s...@narfation.org>
---
 gpsd/alfred-gpsd.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/gpsd/alfred-gpsd.c b/gpsd/alfred-gpsd.c
index 8e2f1f8..bac5711 100644
--- a/gpsd/alfred-gpsd.c
+++ b/gpsd/alfred-gpsd.c
@@ -234,6 +234,7 @@ static int gpsd_read_answer(struct globals *globals)
        struct gpsd_v1 *gpsd_data;
        uint8_t source[ETH_ALEN];
        bool first_line = true;
+       uint32_t tpv_len;
        uint16_t len;
        int ret = 0;
 
@@ -248,16 +249,20 @@ static int gpsd_read_answer(struct globals *globals)
                if (len != GPSD_DATA_SIZE(gpsd_data))
                        continue;
 
+               tpv_len = ntohl(gpsd_data->tpv_len);
+               if (tpv_len == 0)
+                       continue;
+
                if (first_line)
                        first_line = false;
                else
                        printf(",\n");
 
                printf("  { \"source\" : \"%02x:%02x:%02x:%02x:%02x:%02x\", "
-                      "\"tpv\" : %s }",
+                      "\"tpv\" : %.*s }",
                       source[0], source[1], source[2],
                       source[3], source[4], source[5],
-                      gpsd_data->tpv);
+                      tpv_len, gpsd_data->tpv);
        }
        printf("\n]\n");
 

-- 
2.47.3