fix(hidpp10): bound writes in Bolt getDeviceName

[jelmerdehen]

Summary

Receiver::getDeviceName (Bolt branch) trusts the size byte from the device's pairing-info register without validating it against the allocated string. When the device returns a size smaller than chunk_size (1..16), the inner loop writes up to 16 bytes past the end of the std::string buffer, producing a heap-buffer overflow with attacker-controlled bytes.

Impact

logid runs as root via systemd. The response originates from receiver firmware, so a malicious or compromised Bolt receiver, or an RF/USB attacker spoofing the 0x83 register reply, could corrupt the heap of a root process.

Reproducer: any Bolt receiver that returns size < 17 in the first byte of the pairing-info name response.

Fix

• Reject responses shorter than 4 bytes before reading the size byte.
• Bound every inner-loop write against both name.size() and resp.size().
• On the chained register read for follow-on chunks, bail out if the response is short.

Test plan

• Builds cleanly.
• Pair a real Bolt receiver and confirm device names are still read correctly.
• Run under ASan with a stub receiver returning size=1 in the first chunk; previously crashed, now returns truncated name.