The documentation of the function cbor_value_copy_byte_string says:
If the buffer is large enough, this function will insert a null byte after the last copied byte, to facilitate manipulation of null-terminated strings.
However, the null byte is appended without checking if the size of buffer:
CborError _cbor_value_copy_string(const CborValue *value, void *buffer,
size_t *buflen, CborValue *next)
{
bool copied_all;
CborError err = iterate_string_chunks(value, (char*)buffer, buflen, &copied_all, next,
buffer ? (IterateFunction) value->parser->d->cpy : iterate_noop);
if (err) {
return err;
}
if (!copied_all) {
return CborErrorOutOfMemory;
}
if (buffer) {
*((uint8_t *)buffer + *buflen) = '\0';
}
return CborNoError;
}This causes that one byte belonging to some other variable is overwritten.
The documentation of the function cbor_value_copy_byte_string says:
However, the null byte is appended without checking if the size of buffer:
This causes that one byte belonging to some other variable is overwritten.