From b39483add3bb43482c586cbdfa65a18c62fc9f3b Mon Sep 17 00:00:00 2001
From: liquidraver <504870+liquidraver@users.noreply.github.com>
Date: Wed, 20 May 2026 15:40:18 +0200
Subject: [PATCH] fix(companion): null-terminate contact name in
 CMD_ADD_UPDATE_CONTACT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The wire format reserves a 32-byte name field; if the phone sends 32
non-null bytes, ContactInfo::name has no terminator. Subsequent
LOG_INF/LOG_DBG sites using %s with contact.name then read past the
field into adjacent struct bytes (type, flags, out_path_len, ...)
until the first null. No memory corruption — serializeContact uses
StrHelper::strzcpy which is length-bounded — but log output gets
garbage and a paired peer could probe a few bytes of the struct
through log capture.

Sibling handler CMD_SET_CHANNEL at :1593-1594 already does this
defensively. Match the pattern.
---
 zephcore/app/CompanionMesh.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/zephcore/app/CompanionMesh.cpp b/zephcore/app/CompanionMesh.cpp
index 59bbae8..0e2dbe0 100644
--- a/zephcore/app/CompanionMesh.cpp
+++ b/zephcore/app/CompanionMesh.cpp
@@ -1484,6 +1484,7 @@ bool CompanionMesh::handleProtocolFrame(const uint8_t *data, size_t len)
 			c.out_path_len = data[i++];
 			memcpy(c.out_path, &data[i], MAX_PATH_SIZE); i += MAX_PATH_SIZE;
 			memcpy(c.name, &data[i], 32); i += 32;
+			c.name[31] = '\0';  /* defensive null-term — matches CMD_SET_CHANNEL pattern */
 			c.last_advert_timestamp = get_le32(&data[i]); i += 4;
 			c.gps_lat = 0;
 			c.gps_lon = 0;