diff --git a/drivers/lora/rylrxxx.c b/drivers/lora/rylrxxx.c index 7dd4d21a8c1..e5b78fd0f28 100644 --- a/drivers/lora/rylrxxx.c +++ b/drivers/lora/rylrxxx.c @@ -172,7 +172,7 @@ static void on_rx(struct modem_chat *chat, char **argv, uint16_t argc, void *use if (RYLR_IS_RX_PENDING(driver_data->pending_async_flags)) { driver_data->async_rx_cb(driver_data->dev, msg.data, msg.length, msg.rssi, msg.snr, - driver_data->async_user_data); + driver_data->async_user_data); } else { err = k_msgq_put(&driver_data->rx_msgq, &msg, K_NO_WAIT); if (err != 0) { @@ -390,13 +390,15 @@ int rylr_send(const struct device *dev, uint8_t *payload, uint32_t payload_len) goto exit; } - if (cmd_len > CONFIG_LORA_RYLRXX_CMD_BUF_SIZE) { + /* snprintf requires an extra byte for the terminating NULL */ + if (cmd_len > (CONFIG_LORA_RYLRXX_CMD_BUF_SIZE - 1)) { LOG_ERR("payload too long"); err = -EINVAL; goto exit; } - snprintf(data->cmd_buffer, cmd_len + 1, RYLR_CMD_SEND_FORMAT, payload_len, payload); + snprintf(data->cmd_buffer, sizeof(data->cmd_buffer), RYLR_CMD_SEND_FORMAT, payload_len, + payload); data->curr_cmd_len = cmd_len; err = rylr_send_cmd_buffer(dev); if (err != 0) { @@ -437,7 +439,8 @@ int rylr_send_async(const struct device *dev, uint8_t *payload, uint32_t payload } cmd_len = RYLR_CMD_SEND_LENGTH(payload_len); - if (cmd_len > CONFIG_LORA_RYLRXX_CMD_BUF_SIZE) { + /* snprintf requires an extra byte for the terminating NULL */ + if (cmd_len > (CONFIG_LORA_RYLRXX_CMD_BUF_SIZE - 1)) { LOG_ERR("payload too long"); err = -EINVAL; goto bail; @@ -450,8 +453,8 @@ int rylr_send_async(const struct device *dev, uint8_t *payload, uint32_t payload } data->async_tx_signal = async; - data->curr_cmd_len = - snprintf(data->cmd_buffer, cmd_len + 1, RYLR_CMD_SEND_FORMAT, payload_len, payload); + data->curr_cmd_len = snprintf(data->cmd_buffer, sizeof(data->cmd_buffer), + RYLR_CMD_SEND_FORMAT, payload_len, payload); rylr_reset_dynamic_script(data); data->dynamic_chat.request = data->cmd_buffer; data->dynamic_chat.request_size = data->curr_cmd_len;