1 files changed, 18 insertions, 16 deletions

diff --git a/src/libirecovery.c b/src/libirecovery.c
index 45447c0..f544fbd 100644
--- a/src/libirecovery.c
+++ b/src/libirecovery.c
@@ -738,10 +738,10 @@ static int irecv_get_string_descriptor_ascii(irecv_client_t client, uint8_t desc
 	unsigned short langid = 0;
 	unsigned char data[256];
 	int di, si;
-	memset(data, 0, 256);
+	memset(data, 0, sizeof(data));
 	memset(buffer, 0, size);
 
-	ret = irecv_usb_control_transfer(client, 0x80, 0x06, (0x03 << 8) | desc_index, langid, data, 255, USB_TIMEOUT);
+	ret = irecv_usb_control_transfer(client, 0x80, 0x06, (0x03 << 8) | desc_index, langid, data, sizeof(data)-1, USB_TIMEOUT);
 
 	if (ret < 0) return ret;
 	if (data[1] != 0x03) return IRECV_E_UNKNOWN_ERROR;
@@ -928,8 +928,8 @@ static void irecv_copy_nonce_with_tag(irecv_client_t client, const char* tag, un
 	*nonce = NULL;
 	*nonce_size = 0;
 
-	memset(buf, 0, 256);
-	len = irecv_get_string_descriptor_ascii(client, 1, (unsigned char*) buf, 255);
+	memset(buf, 0, sizeof(buf));
+	len = irecv_get_string_descriptor_ascii(client, 1, (unsigned char*)buf, sizeof(buf)-1);
 	if (len < 0) {
 		debug("%s: got length: %d\n", __func__, len);
 		return;
@@ -1717,8 +1717,8 @@ static irecv_error_t libusb_usb_open_handle_with_descriptor_and_ecid(irecv_clien
 
 	if (client->mode != KIS_PRODUCT_ID) {
 		char serial_str[256];
-		memset(serial_str, 0, 256);
-		irecv_get_string_descriptor_ascii(client, usb_descriptor->iSerialNumber, (unsigned char*)serial_str, 255);
+		memset(serial_str, 0, sizeof(serial_str));
+		irecv_get_string_descriptor_ascii(client, usb_descriptor->iSerialNumber, (unsigned char*)serial_str, sizeof(serial_str)-1);
 		irecv_load_device_info_from_iboot_string(client, serial_str);
 	}
 
@@ -2275,7 +2275,7 @@ static void* _irecv_handle_device_add(void *userdata)
 	irecv_error_t error = 0;
 	irecv_client_t client = NULL;
 
-	memset(serial_str, 0, 256);
+	memset(serial_str, 0, sizeof(serial_str));
 #ifdef _WIN32
 	struct irecv_win_dev_ctx *win_ctx = (struct irecv_win_dev_ctx*)userdata;
 	PSP_DEVICE_INTERFACE_DETAIL_DATA_A details = win_ctx->details;
@@ -2422,7 +2422,7 @@ static void* _irecv_handle_device_add(void *userdata)
 
 		product_id = client->mode;
 	} else {
-		libusb_error = libusb_get_string_descriptor_ascii(usb_handle, devdesc.iSerialNumber, (unsigned char*)serial_str, 255);
+		libusb_error = libusb_get_string_descriptor_ascii(usb_handle, devdesc.iSerialNumber, (unsigned char*)serial_str, sizeof(serial_str)-1);
 		if (libusb_error < 0) {
 			debug("%s: Failed to get string descriptor: %s\n", __func__, libusb_error_name(libusb_error));
 			return 0;
@@ -3219,8 +3219,8 @@ static irecv_error_t irecv_get_status(irecv_client_t client, unsigned int* statu
 	}
 
 	unsigned char buffer[6];
-	memset(buffer, '\0', 6);
-	if (irecv_usb_control_transfer(client, 0xA1, 3, 0, 0, buffer, 6, USB_TIMEOUT) != 6) {
+	memset(buffer, '\0', sizeof(buffer));
+	if (irecv_usb_control_transfer(client, 0xA1, 3, 0, 0, buffer, sizeof(buffer), USB_TIMEOUT) != sizeof(buffer)) {
 		*status = 0;
 		return IRECV_E_USB_STATUS;
 	}
@@ -3559,13 +3559,14 @@ irecv_error_t irecv_getenv(irecv_client_t client, const char* variable, char** v
 		return error;
 	}
 
-	char* response = (char*) malloc(256);
+	int rsize = 256;
+	char* response = (char*) malloc(rsize);
 	if (response == NULL) {
 		return IRECV_E_OUT_OF_MEMORY;
 	}
 
-	memset(response, '\0', 256);
-	irecv_usb_control_transfer(client, 0xC0, 0, 0, 0, (unsigned char*) response, 255, USB_TIMEOUT);
+	memset(response, '\0', rsize);
+	irecv_usb_control_transfer(client, 0xC0, 0, 0, 0, (unsigned char*) response, rsize-1, USB_TIMEOUT);
 
 	*value = response;
 
@@ -3583,13 +3584,14 @@ irecv_error_t irecv_getret(irecv_client_t client, unsigned int* value)
 
 	*value = 0;
 
-	char* response = (char*) malloc(256);
+	int rsize = 256;
+	char* response = (char*) malloc(rsize);
 	if (response == NULL) {
 		return IRECV_E_OUT_OF_MEMORY;
 	}
 
-	memset(response, '\0', 256);
-	irecv_usb_control_transfer(client, 0xC0, 0, 0, 0, (unsigned char*) response, 255, USB_TIMEOUT);
+	memset(response, '\0', rsize);
+	irecv_usb_control_transfer(client, 0xC0, 0, 0, 0, (unsigned char*) response, rsize-1, USB_TIMEOUT);
 
 	*value = (unsigned int) *response;