[PATCH v2 2/2] net: lwip: dhcp: Do not write past end of buffer

[Jerome Forissier]

On 14/01/2026 16:12, Andrew Goodbody wrote:
> sprintf will write a trailing \0 at the end of the string so when
> writing into a buffer, that buffer must be sized to allow for that
> trailing zero. In the DHCP code when the index is a number needing two
> digits to express the index would use up the two \0 bytes in the buffer
> and the trailing \0 from sprintf would be beyond the end of the
> allocation. Fix this by adding a third \0 in the buffer.
> 
> This was found by code inspection when looking for an issue reported by
> Michal Simek, but I do not have the hardware to reproduce, so cannot
> confirm if this addresses that issue or not.
> 
> Fixes: 98ad145db61a ("net: lwip: add DHCP support and dhcp commmand")
> Signed-off-by: Andrew Goodbody <andrew.goodbody at linaro.org>
> ---
>  net/lwip/dhcp.c     | 6 +++---
>  net/lwip/net-lwip.c | 6 +++---
>  2 files changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/net/lwip/dhcp.c b/net/lwip/dhcp.c
> index b798014ebcb97dee688e29ccb34da916296c6772..731b57de3ba4336a22fee5957b6e2163360d78a1 100644
> --- a/net/lwip/dhcp.c
> +++ b/net/lwip/dhcp.c
> @@ -30,9 +30,9 @@ static void call_lwip_dhcp_fine_tmr(void *ctx)
>  
>  static int dhcp_loop(struct udevice *udev)
>  {
> -	char ipstr[] = "ipaddr\0\0";
> -	char maskstr[] = "netmask\0\0";
> -	char gwstr[] = "gatewayip\0\0";
> +	char ipstr[] = "ipaddr\0\0\0";
> +	char maskstr[] = "netmask\0\0\0";
> +	char gwstr[] = "gatewayip\0\0\0";
>  	const ip_addr_t *ntpserverip;
>  	unsigned long start;
>  	struct netif *netif;
> diff --git a/net/lwip/net-lwip.c b/net/lwip/net-lwip.c
> index 8741f65fe12e23cc30068506453a762533f8a67f..0fa33730a636727d0718625215a69002242810d0 100644
> --- a/net/lwip/net-lwip.c
> +++ b/net/lwip/net-lwip.c
> @@ -108,9 +108,9 @@ struct netif *net_lwip_get_netif(void)
>  static int get_udev_ipv4_info(struct udevice *dev, ip4_addr_t *ip,
>  			      ip4_addr_t *mask, ip4_addr_t *gw)
>  {
> -	char ipstr[] = "ipaddr\0\0";
> -	char maskstr[] = "netmask\0\0";
> -	char gwstr[] = "gatewayip\0\0";
> +	char ipstr[] = "ipaddr\0\0\0";
> +	char maskstr[] = "netmask\0\0\0";
> +	char gwstr[] = "gatewayip\0\0\0";
>  	int idx = dev_seq(dev);
>  	char *env;
>  
> 

Reviewed-by: Jerome Forissier <jerome.forissier at arm.com>

Thanks,
-- 
Jerome