From: luozheng <1732036298@qq.com>
Date: Sat, 25 Oct 2025 03:22:44 +0000 (+0800)
Subject: 272，230，n9，解决绑定死机问题
X-Git-Tag: V1.0.9_20251128_194606_LN~170^2~4
X-Git-Url: http://git.snicker.com.cn/?a=commitdiff_plain;h=9ceb21320897be291db98e81828f27b13c8241b0;p=mirrors%2FFD230.git

272，230，n9，解决绑定死机问题
---

diff --git a/code/sdk/application/wearable/fd230/service/msg_center/src/msg_center_customer.cpp b/code/sdk/application/wearable/fd230/service/msg_center/src/msg_center_customer.cpp
index c311cc7ee..7c70c93d3 100644
--- a/code/sdk/application/wearable/fd230/service/msg_center/src/msg_center_customer.cpp
+++ b/code/sdk/application/wearable/fd230/service/msg_center/src/msg_center_customer.cpp
@@ -460,22 +460,29 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
     //     display_api->turn_on_screen();
     // }
     uint8_t* data=(uint8_t*)req->data;
-    uint8_t len_name = req->len;
-    char devname[len_name];
-    if(data!=NULL && req->len>=2)
+    /* 安全：固定上限 + 显式终止 */
+    const size_t kMaxDevName = 64;
+    char devname[kMaxDevName + 1] = {0};
+    if (data != NULL && req->len >= 2)
     {
         switch(data[0])
         {
             case DEVICEBIND:
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    /* 设备名在 payload[2..]，长度为 req->len-2，做边界裁剪并追加'\0' */
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 if(NotificationManager::GetInstance()->HasNotifyShowing())
                 {
@@ -486,15 +493,19 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
             case DEVICEUNBIND:
                 
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    // printf("devname:%s\r\n",devname);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 NotificationManager::GetInstance()->ShowNotify(showDeviceUnBindingNotify, (uint16_t)topic, true);
                 break;
diff --git a/code/sdk/application/wearable/fd272/service/msg_center/src/msg_center_customer.cpp b/code/sdk/application/wearable/fd272/service/msg_center/src/msg_center_customer.cpp
index 5ece3e42d..654cbd8f9 100644
--- a/code/sdk/application/wearable/fd272/service/msg_center/src/msg_center_customer.cpp
+++ b/code/sdk/application/wearable/fd272/service/msg_center/src/msg_center_customer.cpp
@@ -455,22 +455,29 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
     //     display_api->turn_on_screen();
     // }
     uint8_t* data=(uint8_t*)req->data;
-    uint8_t len_name = req->len;
-    char devname[len_name];
-    if(data!=NULL && req->len>=2)
+    /* 安全：固定上限 + 显式终止 */
+    const size_t kMaxDevName = 64;
+    char devname[kMaxDevName + 1] = {0};
+    if (data != NULL && req->len >= 2)
     {
         switch(data[0])
         {
             case DEVICEBIND:
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    /* 设备名在 payload[2..]，长度为 req->len-2，做边界裁剪并追加'\0' */
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 if(NotificationManager::GetInstance()->HasNotifyShowing())
                 {
@@ -481,15 +488,19 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
             case DEVICEUNBIND:
                 
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    // printf("devname:%s\r\n",devname);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 NotificationManager::GetInstance()->ShowNotify(showDeviceUnBindingNotify, (uint16_t)topic, true);
                 break;
diff --git a/code/sdk/application/wearable/n9/service/msg_center/src/msg_center_customer.cpp b/code/sdk/application/wearable/n9/service/msg_center/src/msg_center_customer.cpp
index 4ddd2466f..395beb40c 100644
--- a/code/sdk/application/wearable/n9/service/msg_center/src/msg_center_customer.cpp
+++ b/code/sdk/application/wearable/n9/service/msg_center/src/msg_center_customer.cpp
@@ -455,22 +455,29 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
     //     display_api->turn_on_screen();
     // }
     uint8_t* data=(uint8_t*)req->data;
-    uint8_t len_name = req->len;
-    char devname[len_name];
-    if(data!=NULL && req->len>=2)
+    /* 安全：固定上限 + 显式终止 */
+    const size_t kMaxDevName = 64;
+    char devname[kMaxDevName + 1] = {0};
+    if (data != NULL && req->len >= 2)
     {
         switch(data[0])
         {
             case DEVICEBIND:
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    /* 设备名在 payload[2..]，长度为 req->len-2，做边界裁剪并追加'\0' */
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 if(NotificationManager::GetInstance()->HasNotifyShowing())
                 {
@@ -481,15 +488,19 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
             case DEVICEUNBIND:
                 
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    // printf("devname:%s\r\n",devname);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 NotificationManager::GetInstance()->ShowNotify(showDeviceUnBindingNotify, (uint16_t)topic, true);
                 break;