- memset(name, 0, sizeof(name));
- end = strchr(start, ',');
- if (!end)
- end = str + strlen(str);
- if (start >= end)
- break;
- strncpy(name, start, end - start);
+ size_t len;
+ memset(name, 0, sizeof(name));
+ end = strchr(start, ',');
+ if (end == NULL)
+ end = str + strlen(str);
+ if (start >= end)
+ break;
+ len = end - start;
+ if (len >= sizeof(name))
+ return -E2BIG;
+ strncpy(name, start, len);
+ name[len] = '\0';