272，230，n9，解决绑定死机问题

diff --git a/code/sdk/application/wearable/fd230/service/msg_center/src/msg_center_customer.cpp b/code/sdk/application/wearable/fd230/service/msg_center/src/msg_center_customer.cpp
index c311cc7..7c70c93 100644 (file)
--- a/code/sdk/application/wearable/fd230/service/msg_center/src/msg_center_customer.cpp
+++ b/code/sdk/application/wearable/fd230/service/msg_center/src/msg_center_customer.cpp
@@ -460,22 +460,29 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
     //     display_api->turn_on_screen();
     // }
     uint8_t* data=(uint8_t*)req->data;
-    uint8_t len_name = req->len;
-    char devname[len_name];
-    if(data!=NULL && req->len>=2)
+    /* 安全：固定上限 + 显式终止 */
+    const size_t kMaxDevName = 64;
+    char devname[kMaxDevName + 1] = {0};
+    if (data != NULL && req->len >= 2)
     {
         switch(data[0])
         {
             case DEVICEBIND:
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    /* 设备名在 payload[2..]，长度为 req->len-2，做边界裁剪并追加'\0' */
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 if(NotificationManager::GetInstance()->HasNotifyShowing())
                 {
@@ -486,15 +493,19 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
             case DEVICEUNBIND:
                 
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    // printf("devname:%s\r\n",devname);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 NotificationManager::GetInstance()->ShowNotify(showDeviceUnBindingNotify, (uint16_t)topic, true);
                 break;

diff --git a/code/sdk/application/wearable/fd272/service/msg_center/src/msg_center_customer.cpp b/code/sdk/application/wearable/fd272/service/msg_center/src/msg_center_customer.cpp
index 5ece3e4..654cbd8 100644 (file)
--- a/code/sdk/application/wearable/fd272/service/msg_center/src/msg_center_customer.cpp
+++ b/code/sdk/application/wearable/fd272/service/msg_center/src/msg_center_customer.cpp
@@ -455,22 +455,29 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
     //     display_api->turn_on_screen();
     // }
     uint8_t* data=(uint8_t*)req->data;
-    uint8_t len_name = req->len;
-    char devname[len_name];
-    if(data!=NULL && req->len>=2)
+    /* 安全：固定上限 + 显式终止 */
+    const size_t kMaxDevName = 64;
+    char devname[kMaxDevName + 1] = {0};
+    if (data != NULL && req->len >= 2)
     {
         switch(data[0])
         {
             case DEVICEBIND:
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    /* 设备名在 payload[2..]，长度为 req->len-2，做边界裁剪并追加'\0' */
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 if(NotificationManager::GetInstance()->HasNotifyShowing())
                 {
@@ -481,15 +488,19 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
             case DEVICEUNBIND:
                 
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    // printf("devname:%s\r\n",devname);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 NotificationManager::GetInstance()->ShowNotify(showDeviceUnBindingNotify, (uint16_t)topic, true);
                 break;

diff --git a/code/sdk/application/wearable/n9/service/msg_center/src/msg_center_customer.cpp b/code/sdk/application/wearable/n9/service/msg_center/src/msg_center_customer.cpp
index 4ddd246..395beb4 100644 (file)
--- a/code/sdk/application/wearable/n9/service/msg_center/src/msg_center_customer.cpp
+++ b/code/sdk/application/wearable/n9/service/msg_center/src/msg_center_customer.cpp
@@ -455,22 +455,29 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
     //     display_api->turn_on_screen();
     // }
     uint8_t* data=(uint8_t*)req->data;
-    uint8_t len_name = req->len;
-    char devname[len_name];
-    if(data!=NULL && req->len>=2)
+    /* 安全：固定上限 + 显式终止 */
+    const size_t kMaxDevName = 64;
+    char devname[kMaxDevName + 1] = {0};
+    if (data != NULL && req->len >= 2)
     {
         switch(data[0])
         {
             case DEVICEBIND:
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    /* 设备名在 payload[2..]，长度为 req->len-2，做边界裁剪并追加'\0' */
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 if(NotificationManager::GetInstance()->HasNotifyShowing())
                 {
@@ -481,15 +488,19 @@ void MsgCenterNotifyDeviceBindProc(const Topic topic, Request* req)
             case DEVICEUNBIND:
                 
                 NotificationManager::GetInstance()->SetNotifyPriority(PRIORITY_ONE);
-                len_name = req->len-2;
-                memset(devname,0,len_name);
-                if(len_name > 0)
                 {
-                    memcpy(devname,(char *)req->data+2,len_name);
-                    // printf("devname:%s\r\n",devname);
-                    PairingViewEventListener::GetInstance().SetDeviceName(devname);
-                }else{
-                    PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    size_t name_len = (req->len > 2) ? (size_t)req->len - 2 : 0;
+                    if (name_len > 0)
+                    {
+                        size_t copy_len = (name_len > kMaxDevName) ? kMaxDevName : name_len;
+                        (void)memcpy_s(devname, sizeof(devname), (const char*)req->data + 2, copy_len);
+                        devname[copy_len] = '\0';
+                        PairingViewEventListener::GetInstance().SetDeviceName(devname);
+                    }
+                    else
+                    {
+                        PairingViewEventListener::GetInstance().SetDeviceName(NULL);
+                    }
                 }
                 NotificationManager::GetInstance()->ShowNotify(showDeviceUnBindingNotify, (uint16_t)topic, true);
                 break;