diff mbox

[RFC] devicetree: Fix buffer overflow on setting device node name

Message ID 20100408015013.18100.89239.stgit@angua
State New
Headers show

Commit Message

Grant Likely April 8, 2010, 1:51 a.m. UTC 
Fix bug where temporary buffer for sprintf() was not large enough
when setting a device tree node name.

Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
---

Hi Jeremy.  Here's the fix I promised.  With this change your current tree
works beautifully.  I've pushed out the kernel that works with this QEMU
branch to my Linux kernel git tree:

git://git.secretlab.ca/git/linux-2.6 test-devicetree

Cheers,
g.

 hw/qdev.c   |    2 +-
 hw/sysbus.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Comments

Jeremy Kerr April 8, 2010, 3:48 a.m. UTC | #1 
Hi Grant,

Thanks, this fixes the overflow for me too. Have applied to my tree and pushed 
out.

If anyone else would like to check out out the patches, my tree is at:

  http://kernel.ubuntu.com/git?p=jk/dt/qemu.git;a=summary
  git://kernel.ubuntu.com/jk/dt/qemu.git

Cheers,


Jeremy
diff mbox

Patch

diff --git a/hw/qdev.c b/hw/qdev.c
index caa5b35..36582ec 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -868,7 +868,7 @@  static int qdev_fdt_add_device(void *fdt, DeviceState *dev, int bus_offset)
 {
     BusState *child;
     int dev_offset, rc;
-    char name[sizeof(dev->info->name) + 9];
+    char name[sizeof(dev->info->name) + 20];
     static int unique = 0;
 
     sprintf(name, "%s@%x", dev->info->name, unique++);
diff --git a/hw/sysbus.c b/hw/sysbus.c
index c63deef..c17d12d 100644
--- a/hw/sysbus.c
+++ b/hw/sysbus.c
@@ -230,7 +230,7 @@  static int sysbus_fdt_populate_node(DeviceState *dev, void *fdt, int offset)
     for (i = 0; i < s->num_mmio; i++) {
         /* By convention, the name is appended with '@<first reg addr>' */
         if (i == 0) {
-            char n[sizeof(dev->info->name) + 10];
+            char n[sizeof(dev->info->name) + 20];
             sprintf(n, "%s@%x", dev->info->name, (uint32_t)s->mmio[i].addr);
             rc = fdt_set_name(fdt, offset, n);
             if (rc < 0)