Mon 19 Jan 2015 02:49:47 PM UTC, original submission:
gpsd_binary_satellite_dump:
The function updates 'len' three times by using the results of snprintf() calls, which is wrong, since snprintf() returns the number of characters which would have been written if enough space had been available, not necessarily the number of characters actually written.
Additionally, after appending "$PRWIZCH" to the buffer the code doesn't update 'len' at all.
gpsd_binary_quality_dump:
The function doesn't modify 'len', so it always contains the size of the output buffer. On the other hand, the function does modify 'bufp', pointing it to the end of generated string. It means, that the following code is incorrect:
In the second line "strlen(bufp)" will be zero, so we're effectively calling "snprintf(bufp, len, ..." with 'bufp' pointing inside the buffer and 'len' containing full length of the buffer.
A few lines later we have similar incorrect code (this time without subtracting zero strlen()):
... and again, both variants in single "if" statement:
|