cmd: img_mgmt: Add an extra byte to the 'hash' buffer

[Olivier-ProGlove]

_cbor_value_copy_string() (invoked by cbor_read_object()) adds a
null-character to the byte string.
Not adding this additional byte to the buffer obviously corrupts the memory.

Signed-off-by: Olivier Martin olivier.martin@proglove.de

cc: @carlescufi, @nvlsianpu

[carlescufi]

@ccollins476ad can you please review? thanks!

[ccollins476ad]

Thanks, Olivier. This looks like a good workaround for the buffer overrun.

The real bug seems to be in the TinyCbor implementation. From _cbor_value_copy_string's heading:

 * On success, this function sets the number of bytes copied to \c{*buflen}. If
 * the buffer is large enough, this function will insert a null byte after the
 * last copied byte, to facilitate manipulation of null-terminated strings.
 * That byte is not included in the returned value of \c{*buflen}.

However, this particular bug is not in the official TinyCbor source (https://github.com/intel/tinycbor), and it is also not in the Mynewt fork. I guess this bug must be an artifact from the original merge to Zephyr.

[carlescufi]

@ccollins476ad I don’t have merge rights on this repo. Mind merging this yourself? Thanks!

[carlescufi]

Cc @MariuszSkamra @sjanc

[carlescufi]

@Olivier-ProGlove @JoeHut will you send a PR to Zephyr to update with this version?

[JoeHut]

@carlescufi Sure.