drivers: sensor: fcx_mldx5: Fix potential buffer overflow in UART frame

[sudarsan-22]

Fix Coverity issue CID 363738 (CWE-120): A potential buffer overflow could occur in fcx_mldx5_uart_send() due to unchecked memcpy() when copying command data into a fixed-size frame buffer.

This patch ensures that the length of the data being copied validated against the remaining buffer size to prevent overruns. Also replaces a redundant strlen() call with the precomputed cmd_data_len.

Fixes: #92634

[jeppenodgaard]

This is the 3rd attempt to fix this Coverity issue:

• #81178
• #82447

This is the original issue:

• #74761.

In theory overflow can happen if a future PR adds a command with too much data, so checking the length can make sense.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[kartben]

@kartben @jeppenodgaard @MaureenHelm PR should be reverted, author Signed-off-by is missing complete last name
https://docs.zephyrproject.org/latest/contribute/guidelines.html#dco-sign-off

It is my understanding that it's a common practice in some regions in India that the full name is only single letter(s) so I don't really see an issue here. Don't forget that Zephyr is a global community :)

[sudarsan-22]

@kartben @jeppenodgaard @MaureenHelm PR should be reverted, author Signed-off-by is missing complete last name
https://docs.zephyrproject.org/latest/contribute/guidelines.html#dco-sign-off

It is my understanding that it's a common practice in some regions in India that the full name is only single letter(s) so I don't really see an issue here. Don't forget that Zephyr is a global community :)

Thank you for pointing @kartben @JarmouniA .
I'd like to clarify that "Sudarsan N" is my full legal name as per my government-issued documents.
It is a common naming convention in my region (India) to use an initial for the family

[JarmouniA]

@kartben @jeppenodgaard @MaureenHelm PR should be reverted, author Signed-off-by is missing complete last name
https://docs.zephyrproject.org/latest/contribute/guidelines.html#dco-sign-off

It is my understanding that it's a common practice in some regions in India that the full name is only single letter(s) so I don't really see an issue here. Don't forget that Zephyr is a global community :)

Thank you for pointing @kartben @JarmouniA . I'd like to clarify that "Sudarsan N" is my full legal name as per my government-issued documents. It is a common naming convention in my region (India) to use an initial for the family

Okey my mistake then, sorry for the noise.