[PATCH v2] xilinx: versal: Fix snprintf invalid size argument

[Francois Berder]

buf is an array of size DFU_ALT_BUF_LEN bytes.
It is gradually filled with data using snprintf but the
size argument to snprintf is kept at DFU_ALT_BUF_LEN,
making it possible to overflow the buffer.
Fix this bug using the correct buffer size:
DFU_ALT_BUF_LEN - len.
Also, replace snprintf by scnprintf, otherwise len
variable is incremented incorrectly. It is now
incremented by the actual character count written
in buf.
    
v2: Replace snprintf by scnprintf

Signed-off-by: Francois Berder <fberder at outlook.fr>
---
 board/xilinx/versal/board.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/board/xilinx/versal/board.c b/board/xilinx/versal/board.c
index 9371c30ea27..88bcd692401 100644
--- a/board/xilinx/versal/board.c
+++ b/board/xilinx/versal/board.c
@@ -418,15 +418,15 @@ void configure_capsule_updates(void)
 	case SD_MODE1:
 		bootseq = mmc_get_env_dev();
 
-		len += snprintf(buf + len, DFU_ALT_BUF_LEN, "mmc %d=boot",
-			       bootseq);
+		len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len, "mmc %d=boot",
+				 bootseq);
 
 		if (multiboot)
-			len += snprintf(buf + len, DFU_ALT_BUF_LEN,
-					"%04d", multiboot);
+			len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len,
+					 "%04d", multiboot);
 
-		len += snprintf(buf + len, DFU_ALT_BUF_LEN, ".bin fat %d 1",
-			       bootseq);
+		len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len, ".bin fat %d 1",
+				 bootseq);
 		break;
 	case QSPI_MODE_24BIT:
 	case QSPI_MODE_32BIT:
@@ -438,9 +438,9 @@ void configure_capsule_updates(void)
 
 			mtd_found_part(&base, &limit);
 
-			len += snprintf(buf + len, DFU_ALT_BUF_LEN,
-					"sf 0:0=boot.bin raw 0x%x 0x%x",
-					base, limit);
+			len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len,
+					 "sf 0:0=boot.bin raw 0x%x 0x%x",
+					 base, limit);
 		}
 		break;
 	default:
-- 
2.43.0