drivers/blazer_usb.c, drivers/nutdrv_qx.c: play safer with temporary buffers, pre-zero some [#3529]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

Author: jimklimov

NEWS.adoc

@@ -134,6 +134,10 @@ https://github.com/networkupstools/nut/milestone/13
     * Drivers with libusb-1.0 code path, and `nutdrv_qx` in particular: revise
       to fix per-close `libusb_exit()` deadlock, and escalate a persistent
       `LIBUSB_ERROR_OVERFLOW` state to USB reset handling. [PR #3448]
+    * Some driver code paths used buffers sent via USB transfers as fixed-size
+      chunks populated only partially with bytes we intended. These buffers are
+      now more diligently pre-zeroed as their siblings were in other code paths,
+      to avoid sending host stack garbage to a device. [#3529]
 
  - NUT client libraries:
     * Complete support for actions documented in `docs/net-protocol.txt`

drivers/blazer_usb.c

@@ -37,7 +37,7 @@
 #endif	/* WIN32 */
 
 #define DRIVER_NAME	"Megatec/Q1 protocol USB driver"
-#define DRIVER_VERSION	"0.24"
+#define DRIVER_VERSION	"0.25"
 
 /* driver description structure */
 upsdrv_info_t upsdrv_info = {
@@ -234,6 +234,7 @@ static int ippon_command(const char *cmd, char *buf, size_t buflen)
 	int	ret, len;
 	size_t	i;
 
+	memset(tmp, 0, sizeof(tmp));
 	snprintf(tmp, sizeof(tmp), "%s", cmd);
 
 	for (i = 0; i < strlen(tmp); i += (size_t)ret) {

drivers/nutdrv_qx.c

@@ -58,7 +58,7 @@
 #	define DRIVER_NAME	"Generic Q* Serial driver"
 #endif	/* QX_USB */
 
-#define DRIVER_VERSION	"0.51"
+#define DRIVER_VERSION	"0.52"
 
 #ifdef QX_SERIAL
 #	include "serial.h"
@@ -923,6 +923,8 @@ static int	phoenix_command(const char *cmd, size_t cmdlen, char *buf, size_t buf
 	for (i = 0; i < 8; i++) {
 
 		/* Read data in 8-byte chunks */
+		memset(tmp, 0, sizeof(tmp));
+
 		/* ret = usb->get_interrupt(udev, (unsigned char *)tmp, 8, 1000); */
 		ret = usb_interrupt_read(udev,
 			0x81,
@@ -1640,6 +1642,7 @@ static int	fuji_command(const char *cmd, size_t cmdlen, char *buf, size_t buflen
 	/* Send command */
 
 	/* Remove the CR */
+	memset(command, 0, sizeof(command));
 	snprintf(command, sizeof(command), "%.*s", (int)strcspn(cmd, "\r"), cmd);
 
 	/* Length of the command that will be sent to the UPS can be
@@ -1947,6 +1950,8 @@ static int ablerex_command(const char *cmd, size_t cmdlen, char *buf, size_t buf
 		int	ret;
 
 		memset(buf, 0, buflen);
+		memset(tmp, 0, sizeof(tmp));
+
 		tmp[0] = 0x05;
 		tmp[1] = 0;
 		tmp[2] = 1 + (char)strcspn(cmd, "\r");