Fix remaining buffer overflows in the CLI command paths

examples/simple_repeater/main.cpp

@@ -149,7 +149,8 @@ void loop() {
   if (len > 0 && command[len - 1] == '\r') {  // received complete line
     Serial.print('\n');
     command[len - 1] = 0;  // replace newline with C string null terminator
-    char reply[160];
+    // 3-byte reflected CLI prefix + 160-byte reply text + NUL
+    char reply[164];
     reply[0] = 0;
 #ifdef ETHERNET_ENABLED
     if (!ethernet_handle_command(command, reply)) {
@@ -170,7 +171,8 @@ void loop() {
 #ifdef ETHERNET_ENABLED
   ethernet_loop_maintain();
   if (ethernet_read_line(ethernet_command, sizeof(ethernet_command))) {
-    char reply[160];
+    // 3-byte reflected CLI prefix + 160-byte reply text + NUL
+    char reply[164];
     reply[0] = 0;
     if (!ethernet_handle_command(ethernet_command, reply)) {
       the_mesh.handleCommand(0, ethernet_command, reply);

examples/simple_room_server/main.cpp

@@ -127,7 +127,8 @@ void loop() {
 
   if (len > 0 && command[len - 1] == '\r') {  // received complete line
     command[len - 1] = 0;  // replace newline with C string null terminator
-    char reply[160];
+    // 3-byte reflected CLI prefix + 160-byte reply text + NUL
+    char reply[164];
     reply[0] = 0;
 #ifdef ETHERNET_ENABLED
     if (!ethernet_handle_command(command, reply)) {
@@ -146,7 +147,8 @@ void loop() {
 #ifdef ETHERNET_ENABLED
   ethernet_loop_maintain();
   if (ethernet_read_line(ethernet_command, sizeof(ethernet_command))) {
-    char reply[160];
+    // 3-byte reflected CLI prefix + 160-byte reply text + NUL
+    char reply[164];
     reply[0] = 0;
     if (!ethernet_handle_command(ethernet_command, reply)) {
       the_mesh.handleCommand(0, ethernet_command, reply);

examples/simple_secure_chat/main.cpp

@@ -409,8 +409,7 @@ class MyMesh : public BaseChatMesh, ContactVisitor {
       memcpy(temp, &timestamp, 4);   // mostly an extra blob to help make packet_hash unique
       temp[4] = 0;  // attempt and flags
 
-      sprintf((char *) &temp[5], "%s: %s", _prefs.node_name, &command[7]);  // <sender>: <msg>
-      temp[5 + MAX_TEXT_LEN] = 0;  // truncate if too long
+      snprintf((char *) &temp[5], MAX_TEXT_LEN + 1, "%s: %s", _prefs.node_name, &command[7]);  // <sender>: <msg>
 
       int len = strlen((char *) &temp[5]);
       auto pkt = createGroupDatagram(PAYLOAD_TYPE_GRP_TXT, _public->channel, temp, 5 + len);

examples/simple_sensor/main.cpp

@@ -144,7 +144,8 @@ void loop() {
 
   if (len > 0 && command[len - 1] == '\r') {  // received complete line
     command[len - 1] = 0;  // replace newline with C string null terminator
-    char reply[160];
+    // 3-byte reflected CLI prefix + 160-byte reply text + NUL
+    char reply[164];
     the_mesh.handleCommand(NULL, 0, command, reply);  // NOTE: there is no sender_timestamp via serial!
     if (reply[0]) {
       Serial.print("  -> "); Serial.println(reply);

src/helpers/CommonCLI.cpp

@@ -252,7 +252,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, char* command, char* re
         strcpy(reply, "ERR: bad pubkey");
       }
     } else if (memcmp(command, "tempradio ", 10) == 0) {
-      strcpy(tmp, &command[10]);
+      StrHelper::strncpy(tmp, &command[10], sizeof(tmp));
       const char *parts[5];
       int num = mesh::Utils::parseTextParts(tmp, parts, 5);
       float freq  = num > 0 ? strtof(parts[0], nullptr) : 0.0f;
@@ -308,7 +308,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, char* command, char* re
         strcpy(reply, "null");
       }
     } else if (memcmp(command, "sensor set ", 11) == 0) {
-      strcpy(tmp, &command[11]);
+      StrHelper::strncpy(tmp, &command[11], sizeof(tmp));
       const char *parts[2];
       int num = mesh::Utils::parseTextParts(tmp, parts, 2, ' ');
       const char *key = (num > 0) ? parts[0] : "";
@@ -647,7 +647,7 @@ void CommonCLI::handleSetCmd(uint32_t sender_timestamp, char* command, char* rep
     };
   #if defined(USE_LR2021)
   } else if (memcmp(config, "extra.sf ", 9) == 0) {
-    strcpy(tmp, &config[9]);
+    StrHelper::strncpy(tmp, &config[9], sizeof(tmp));
     const char *parts[4];
     uint8_t sideDetSFs[4];
     int num = mesh::Utils::parseTextParts(tmp, parts, 4);
@@ -819,7 +819,7 @@ void CommonCLI::handleGetCmd(uint32_t sender_timestamp, char* command, char* rep
       sprintf(reply, "No extra SF configured");
     }
   } else {
-    sprintf(reply, "??: %s", config);
+    snprintf(reply, 160, "??: %s", config);
   }
 }
 

src/helpers/CommonRadioPrefs.cpp

@@ -54,7 +54,7 @@ bool CommonRadioPrefs::handleCommand(const char* command, uint32_t sender_timest
   }
   if (memcmp(command, "set radio ", 10) == 0) {
     char tmp[132];
-    strcpy(tmp, &command[10]);
+    StrHelper::strncpy(tmp, &command[10], sizeof(tmp));
     const char *parts[4];
     int num = mesh::Utils::parseTextParts(tmp, parts, 4);
     float freq  = num > 0 ? strtof(parts[0], nullptr) : 0.0f;

src/helpers/DynamicConfigSerializer.cpp

@@ -67,8 +67,8 @@ bool DynamicConfigSerializer::getByKey(const char* key, char* value, size_t max_
   for (int i = 0; i < n; i++) {
     const char* item = parts[i];
     if (item[keylen] == KEY_SEP_CHAR && memcmp(item, key, keylen) == 0) {
-      strncpy(value, &item[keylen+1], max_len);
-      value[max_len] = 0;
+      strncpy(value, &item[keylen+1], max_len - 1);   // max_len inclusive of null
+      value[max_len - 1] = 0;
       return true;
     }
   }