diff mbox series

[U-Boot,1/1] siemens: avoid out of bound access

Message ID 20190822195826.10142-1-xypron.glpk@gmx.de
State Accepted
Commit 3c7166dbb464a65d9822cfee7c233a7d8c1a9672
Delegated to: Tom Rini
Headers show
Series [U-Boot,1/1] siemens: avoid out of bound access | expand

Commit Message

Heinrich Schuchardt Aug. 22, 2019, 7:58 p.m. UTC 
char num[1];
	sprintf(num, "%d", i);

leads to a buffer overrun.

Simplify the overly complex coding.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 board/siemens/common/board.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--
2.20.1

Comments

Bin Meng Aug. 23, 2019, 3:30 a.m. UTC | #1 
On Fri, Aug 23, 2019 at 3:59 AM Heinrich Schuchardt <xypron.glpk@gmx.de> wrote:
>
>         char num[1];
>         sprintf(num, "%d", i);
>
> leads to a buffer overrun.
>
> Simplify the overly complex coding.
>
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> ---
>  board/siemens/common/board.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
>

Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Heiko Schocher Aug. 29, 2019, 5:38 a.m. UTC | #2 
Hello Heinrich,

Am 22.08.2019 um 21:58 schrieb Heinrich Schuchardt:
> 	char num[1];
> 	sprintf(num, "%d", i);
> 
> leads to a buffer overrun.
> 
> Simplify the overly complex coding.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> ---
>   board/siemens/common/board.c | 5 +----
>   1 file changed, 1 insertion(+), 4 deletions(-)

Thanks!

Acked-by: Heiko Schocher <hs@denx.de>

bye,
Heiko
Tom Rini Sept. 2, 2019, 2:13 p.m. UTC | #3 
On Thu, Aug 22, 2019 at 09:58:26PM +0200, Heinrich Schuchardt wrote:

> char num[1];
> 	sprintf(num, "%d", i);
> 
> leads to a buffer overrun.
> 
> Simplify the overly complex coding.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
> Acked-by: Heiko Schocher <hs@denx.de>

Applied to u-boot/master, thanks!
diff mbox series

Patch

diff --git a/board/siemens/common/board.c b/board/siemens/common/board.c
index 676935a843..75462d1c34 100644
--- a/board/siemens/common/board.c
+++ b/board/siemens/common/board.c
@@ -189,14 +189,11 @@  void set_env_gpios(unsigned char state)
 {
 	char *ptr_env;
 	char str_tmp[5];	/* must contain "ledX"*/
-	char num[1];
 	unsigned char i, idx, pos1, pos2, ccount;
 	unsigned char gpio_n, gpio_s0, gpio_s1;

 	for (i = 0; i < MAX_NR_LEDS; i++) {
-		strcpy(str_tmp, "led");
-		sprintf(num, "%d", i);
-		strcat(str_tmp, num);
+		sprintf(str_tmp, "led%d", i);

 		/* If env var is not found we stop */
 		ptr_env = env_get(str_tmp);