From 1d5f816874ece11120c478c9c56f2e8aacd4b1bf Mon Sep 17 00:00:00 2001
From: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
Date: Sat, 11 Jul 2026 00:19:13 +0800
Subject: [PATCH] system: audio: parse command filenames with PATH_MAX

Parse command filename tokens into PATH_MAX-sized buffers before
reading optional raw audio parameters. This bounds nxplayer and
nxrecorder input without runtime-built scanf formats.

Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
---
 system/nxplayer/nxplayer_main.c     | 17 ++++++++++++---
 system/nxrecorder/nxrecorder_main.c | 34 ++++++++++++++++++++++++-----
 2 files changed, 42 insertions(+), 9 deletions(-)

diff --git a/system/nxplayer/nxplayer_main.c b/system/nxplayer/nxplayer_main.c
index 5200c08f9..5ab707163 100644
--- a/system/nxplayer/nxplayer_main.c
+++ b/system/nxplayer/nxplayer_main.c
@@ -317,10 +317,21 @@ static int nxplayer_cmd_playraw(FAR struct nxplayer_s *pplayer, char *parg)
   int bpsamp = 0;
   int samprate = 0;
   int chmap = 0;
-  char filename[128];
+  size_t len;
+  char filename[PATH_MAX];
 
-  sscanf(parg, "%s %d %d %d %d", filename, &channels, &bpsamp,
-                                 &samprate, &chmap);
+  parg += strspn(parg, " \t\r\n");
+  len = strcspn(parg, " \t\r\n");
+  if (len >= sizeof(filename))
+    {
+      len = sizeof(filename) - 1;
+    }
+
+  memcpy(filename, parg, len);
+  filename[len] = '\0';
+
+  sscanf(parg + len, "%d %d %d %d", &channels, &bpsamp,
+         &samprate, &chmap);
 
   /* Try to play the file specified */
 
diff --git a/system/nxrecorder/nxrecorder_main.c b/system/nxrecorder/nxrecorder_main.c
index a8a4c63d6..485784a03 100644
--- a/system/nxrecorder/nxrecorder_main.c
+++ b/system/nxrecorder/nxrecorder_main.c
@@ -190,10 +190,21 @@ static int nxrecorder_cmd_recordraw(FAR struct nxrecorder_s *precorder,
   int bpsamp = 0;
   int samprate = 0;
   int chmap = 0;
-  char filename[128];
+  size_t len;
+  char filename[PATH_MAX];
 
-  sscanf(parg, "%s %d %d %d %d", filename, &channels, &bpsamp,
-                                 &samprate, &chmap);
+  parg += strspn(parg, " \t\r\n");
+  len = strcspn(parg, " \t\r\n");
+  if (len >= sizeof(filename))
+    {
+      len = sizeof(filename) - 1;
+    }
+
+  memcpy(filename, parg, len);
+  filename[len] = '\0';
+
+  sscanf(parg + len, "%d %d %d %d", &channels, &bpsamp,
+         &samprate, &chmap);
 
   /* Try to record the file specified */
 
@@ -259,10 +270,21 @@ static int nxrecorder_cmd_record(FAR struct nxrecorder_s *precorder,
   int bpsamp = 0;
   int samprate = 0;
   int chmap = 0;
-  char filename[128];
+  size_t len;
+  char filename[PATH_MAX];
 
-  sscanf(parg, "%s %d %d %d %d", filename, &channels, &bpsamp,
-                                 &samprate, &chmap);
+  parg += strspn(parg, " \t\r\n");
+  len = strcspn(parg, " \t\r\n");
+  if (len >= sizeof(filename))
+    {
+      len = sizeof(filename) - 1;
+    }
+
+  memcpy(filename, parg, len);
+  filename[len] = '\0';
+
+  sscanf(parg + len, "%d %d %d %d", &channels, &bpsamp,
+         &samprate, &chmap);
 
   /* Try to record the file specified */