Buffer overflow in Companion Wizard

companion/src/eeprominterface.h

@@ -635,6 +635,8 @@ enum MltpxValue {
   MLTPX_REP=2
 };
 
+#define MIXDATA_NAME_LEN  10
+
 class MixData {
   public:
     MixData() { clear(); }
@@ -653,7 +655,7 @@ class MixData {
     unsigned int mixWarn;           // mixer warning
     unsigned int phases;             // -5=!FP4, 0=normal, 5=FP4
     int    sOffset;
-    char   name[10+1];
+    char   name[MIXDATA_NAME_LEN+1];
 
     void clear() { memset(this, 0, sizeof(MixData)); }
 };

companion/src/wizarddata.cpp

@@ -42,8 +42,8 @@ WizMix::WizMix(const GeneralSettings & settings, const unsigned int modelId):
 
 void WizMix::maxMixSwitch(char *name, MixData &mix, int channel, int sw, int weight)
 {
-  strncpy(mix.name, name, sizeof(mix.name));
-  mix.name[sizeof(mix.name)]=0;
+  strncpy(mix.name, name, MIXDATA_NAME_LEN);
+  mix.name[MIXDATA_NAME_LEN] = '\0';
   mix.destCh = channel;
   mix.srcRaw = RawSource(SOURCE_TYPE_MAX);
   mix.swtch  = RawSwitch(SWITCH_TYPE_SWITCH, sw);