From 64a389ae661d92aa81030a3fe6d20979a35ebc98 Mon Sep 17 00:00:00 2001 From: Dom Cobley Date: Tue, 10 Nov 2026 23:11:04 +0000 Subject: [PATCH 1/2] vcgencmd: Include the response word in the gencmd buffer length The GET_GENCMD_RESULT value buffer is the response word followed by MAX_STRING bytes for the command and result, but buffer_len was set to MAX_STRING. The firmware would then look for the next tag in the last word of the command area, which is uninitialised. Set buffer_len to MAX_STRING + 4. --- vcgencmd/vcgencmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vcgencmd/vcgencmd.c b/vcgencmd/vcgencmd.c index 63faf2e..ee70db0 100644 --- a/vcgencmd/vcgencmd.c +++ b/vcgencmd/vcgencmd.c @@ -98,7 +98,7 @@ static unsigned gencmd(int file_desc, const char *command, char *result, int res p[i++] = 0x00000000; // process request p[i++] = GET_GENCMD_RESULT; // (the tag id) - p[i++] = MAX_STRING;// buffer_len + p[i++] = MAX_STRING + 4; // buffer_len: response word + command/result p[i++] = 0; // request_len (set to response length) p[i++] = 0; // error repsonse From 724b5a84a036a9849fc1bc94905a5ac9c8e4d9d9 Mon Sep 17 00:00:00 2001 From: Dom Cobley Date: Tue, 10 Nov 2026 23:31:04 +0000 Subject: [PATCH 2/2] vcgencmd: Leave room for the terminator when copying the result strncat appends up to n characters and then a terminating zero, so passing the full size of the result buffer could write one byte past its end when the firmware's reply fills it. Pass result_len - 1. --- vcgencmd/vcgencmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vcgencmd/vcgencmd.c b/vcgencmd/vcgencmd.c index ee70db0..15b54ce 100644 --- a/vcgencmd/vcgencmd.c +++ b/vcgencmd/vcgencmd.c @@ -110,7 +110,7 @@ static unsigned gencmd(int file_desc, const char *command, char *result, int res mbox_property(file_desc, p); result[0] = 0; - strncat(result, (const char *)(p+6), result_len); + strncat(result, (const char *)(p+6), result_len - 1); return p[5]; }