[PATCH v2] xilinx: zynqmp: Fix snprintf invalid size argument

[Francois Berder]

buf is an array of size DFU_ALT_BUF_LEN bytes.
It is gradually filled with data using snprintf but the
size argument to snprintf is kept at DFU_ALT_BUF_LEN,
making it possible to overflow the buffer.
Fix this bug using the correct buffer size:
DFU_ALT_BUF_LEN - len.
Also, replace snprintf by scnprintf, otherwise len
variable is incremented incorrectly. It is now
incremented by the actual character count written
in buf.

v2: Replace snprintf by scnprintf

Signed-off-by: Francois Berder <fberder at outlook.fr>
---
 board/xilinx/zynqmp/zynqmp.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c
index a1d8ae26673..9a2f53003bb 100644
--- a/board/xilinx/zynqmp/zynqmp.c
+++ b/board/xilinx/zynqmp/zynqmp.c
@@ -706,21 +706,21 @@ void configure_capsule_updates(void)
 	case SD_MODE1:
 		bootseq = mmc_get_env_dev();
 
-		len += snprintf(buf + len, DFU_ALT_BUF_LEN, "mmc %d=boot",
-			       bootseq);
+		len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len, "mmc %d=boot",
+				 bootseq);
 
 		if (multiboot)
-			len += snprintf(buf + len, DFU_ALT_BUF_LEN,
-				       "%04d", multiboot);
+			len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len,
+					 "%04d", multiboot);
 
-		len += snprintf(buf + len, DFU_ALT_BUF_LEN, ".bin fat %d 1",
-			       bootseq);
+		len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len, ".bin fat %d 1",
+				 bootseq);
 #if defined(CONFIG_SPL_FS_LOAD_PAYLOAD_NAME)
 		if (strlen(CONFIG_SPL_FS_LOAD_PAYLOAD_NAME))
-			len += snprintf(buf + len, DFU_ALT_BUF_LEN,
-					";%s fat %d 1",
-					CONFIG_SPL_FS_LOAD_PAYLOAD_NAME,
-					bootseq);
+			len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len,
+					 ";%s fat %d 1",
+					 CONFIG_SPL_FS_LOAD_PAYLOAD_NAME,
+					 bootseq);
 #endif
 		break;
 	case QSPI_MODE_24BIT:
@@ -737,15 +737,15 @@ void configure_capsule_updates(void)
 			limit = CONFIG_SYS_SPI_U_BOOT_OFFS;
 #endif
 
-			len += snprintf(buf + len, DFU_ALT_BUF_LEN,
-					"sf 0:0=boot.bin raw 0x%x 0x%x",
-					base, limit);
+			len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len,
+					 "sf 0:0=boot.bin raw 0x%x 0x%x",
+					 base, limit);
 #if defined(CONFIG_SPL_FS_LOAD_PAYLOAD_NAME) && defined(CONFIG_SYS_SPI_U_BOOT_OFFS)
 			if (strlen(CONFIG_SPL_FS_LOAD_PAYLOAD_NAME))
-				len += snprintf(buf + len, DFU_ALT_BUF_LEN,
-						";%s raw 0x%x 0x%x",
-						CONFIG_SPL_FS_LOAD_PAYLOAD_NAME,
-						base + limit, size - limit);
+				len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len,
+						 ";%s raw 0x%x 0x%x",
+						 CONFIG_SPL_FS_LOAD_PAYLOAD_NAME,
+						 base + limit, size - limit);
 #endif
 		}
 		break;
-- 
2.43.0