Use fixed-size SVC name buffer. Validate length.

src/protocols/rdp/guac_svc/svc_service.c

@@ -59,7 +59,8 @@ int VirtualChannelEntry(PCHANNEL_ENTRY_POINTS pEntryPoints) {
     guac_rdp_svc* svc = (guac_rdp_svc*) entry_points_ex->pExtendedData;
 
     /* Init channel def */
-    strcpy(svc_plugin->plugin.channel_def.name, svc->name);
+    strncpy(svc_plugin->plugin.channel_def.name, svc->name,
+            GUAC_RDP_SVC_MAX_LENGTH);
     svc_plugin->plugin.channel_def.options = 
           CHANNEL_OPTION_INITIALIZED
         | CHANNEL_OPTION_ENCRYPT_RDP

src/protocols/rdp/rdp_svc.c

@@ -41,16 +41,25 @@ guac_rdp_svc* guac_rdp_alloc_svc(guac_client* client, char* name) {
 
     /* Init SVC */
     svc->client = client;
-    svc->name = strdup(name);
     svc->plugin = NULL;
     svc->input_pipe = NULL;
     svc->output_pipe = NULL;
 
+    /* Warn about name length */
+    if (strnlen(name, GUAC_RDP_SVC_MAX_LENGTH+1) > GUAC_RDP_SVC_MAX_LENGTH)
+        guac_client_log_info(client,
+                "Static channel name \"%s\" exceeds maximum of %i characters "
+                "and will be truncated",
+                name, GUAC_RDP_SVC_MAX_LENGTH);
+
+    /* Init name */
+    strncpy(svc->name, name, GUAC_RDP_SVC_MAX_LENGTH);
+    svc->name[GUAC_RDP_SVC_MAX_LENGTH] = '\0';
+
     return svc;
 }
 
 void guac_rdp_free_svc(guac_rdp_svc* svc) {
-    free(svc->name);
     free(svc);
 }
 

src/protocols/rdp/rdp_svc.h

@@ -35,6 +35,11 @@
 #include "compat/winpr-stream.h"
 #endif
 
+/**
+ * The maximum number of characters to allow for each channel name.
+ */
+#define GUAC_RDP_SVC_MAX_LENGTH 7
+
 /**
  * Structure describing a static virtual channel, and the corresponding
  * Guacamole pipes.
@@ -54,7 +59,7 @@ typedef struct guac_rdp_svc {
     /**
      * The name of the RDP channel in use, and the name to use for each pipe.
      */
-    char* name;
+    char name[GUAC_RDP_SVC_MAX_LENGTH+1];
 
     /**
      * The pipe opened by the Guacamole client, if any. This should be