[PATCH] net: ti: icssg: Fix portname buffer overflow

[Francois Berder]

portname consists of dev->parent->name ("icssg0-eth",
"icssg1-eth", or "ethernet") and dev->name is the port node
name ("port at 0" or "port at 1").  Every board DTS in the repository
produces a string that overflows the buffer:

"icssg1-eth-port at 0"  17 chars + NUL = 18 bytes  (AM642 EVM, IoT2050)
"ethernet-port at 0"    15 chars + NUL = 16 bytes  (SR-SOM, phyboard)

This commits increases portname to 64 bytes and replaces sprintf
by snprintf so that any future DT node name cannot overflow it
regardless of length.

Signed-off-by: Francois Berder <fberder at outlook.fr>
---
 drivers/net/ti/icssg_prueth.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ti/icssg_prueth.c b/drivers/net/ti/icssg_prueth.c
index 12a162b9d68..4796d0d67cd 100644
--- a/drivers/net/ti/icssg_prueth.c
+++ b/drivers/net/ti/icssg_prueth.c
@@ -496,14 +496,15 @@ static int prueth_port_probe(struct udevice *dev)
 {
 	struct prueth_priv *priv = dev_get_priv(dev);
 	struct prueth *prueth;
-	char portname[15];
+	char portname[64];
 	int ret;
 
 	priv->dev = dev;
 	prueth = dev_get_priv(dev->parent);
 	priv->prueth = prueth;
 
-	sprintf(portname, "%s-%s", dev->parent->name, dev->name);
+	snprintf(portname, sizeof(portname), "%s-%s", dev->parent->name, dev->name);
+	portname[sizeof(portname) - 1] = '\0';
 
 	device_set_name(dev, portname);
 
-- 
2.43.0