From a19fff099883509593a844574b1980aeb4ca926d Mon Sep 17 00:00:00 2001
From: bsongis <bsongis@gmail.com>
Date: Fri, 6 Jun 2014 22:19:09 +0200
Subject: [PATCH] Buffer overflow in Companion Wizard

---
 companion/src/eeprominterface.h | 4 +++-
 companion/src/wizarddata.cpp    | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/companion/src/eeprominterface.h b/companion/src/eeprominterface.h
index 579e06a83..75e197fb0 100644
--- a/companion/src/eeprominterface.h
+++ b/companion/src/eeprominterface.h
@@ -635,6 +635,8 @@ enum MltpxValue {
   MLTPX_REP=2
 };
 
+#define MIXDATA_NAME_LEN  10
+
 class MixData {
   public:
     MixData() { clear(); }
@@ -653,7 +655,7 @@ class MixData {
     unsigned int mixWarn;           // mixer warning
     unsigned int phases;             // -5=!FP4, 0=normal, 5=FP4
     int    sOffset;
-    char   name[10+1];
+    char   name[MIXDATA_NAME_LEN+1];
 
     void clear() { memset(this, 0, sizeof(MixData)); }
 };
diff --git a/companion/src/wizarddata.cpp b/companion/src/wizarddata.cpp
index 8ceb8dcb5..bcdc4dd16 100644
--- a/companion/src/wizarddata.cpp
+++ b/companion/src/wizarddata.cpp
@@ -42,8 +42,8 @@ WizMix::WizMix(const GeneralSettings & settings, const unsigned int modelId):
 
 void WizMix::maxMixSwitch(char *name, MixData &mix, int channel, int sw, int weight)
 {
-  strncpy(mix.name, name, sizeof(mix.name));
-  mix.name[sizeof(mix.name)]=0;
+  strncpy(mix.name, name, MIXDATA_NAME_LEN);
+  mix.name[MIXDATA_NAME_LEN] = '\0';
   mix.destCh = channel;
   mix.srcRaw = RawSource(SOURCE_TYPE_MAX);
   mix.swtch  = RawSwitch(SWITCH_TYPE_SWITCH, sw);