[PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()
Andy Shevchenko
andriy.shevchenko at linux.intel.com
Mon Apr 26 10:35:32 CEST 2021
On Mon, Apr 26, 2021 at 08:08:03AM +0900, Yuichiro Goto wrote:
> Use of strcat() against an uninitialized buffer would lead
> to buffer overflow. This patch fixes it.
Reviewed-by: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
> Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
> Signed-off-by: Yuichiro Goto <goto at k-tech.co.jp>
> Cc: Peter Robinson <pbrobinson at gmail.com>
> Cc: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
> Cc: Nicolas Saenz Julienne <nsaenzjulienne at suse.de>
> ---
>
> Changes for v3:
> - Add a Fixes tag in commit message
> - Refactor the patch per suggestion from Andy Shevchenko
>
> Changes for v2:
> - Add "IOMUX" in title
>
> common/iomux.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/common/iomux.c b/common/iomux.c
> index b9088aa3b5..c428f7110a 100644
> --- a/common/iomux.c
> +++ b/common/iomux.c
> @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new)
> return -ENOMEM;
> }
>
> - strcat(tmp, ",");
> - strcat(tmp, name);
> + if (arg) {
> + strcat(tmp, ",");
> + strcat(tmp, name);
> + }
> + else
> + strcpy(tmp, name);
>
> arg = tmp;
> size = strlen(tmp) + 1;
> --
> 2.17.1
>
--
With Best Regards,
Andy Shevchenko
More information about the U-Boot
mailing list