| Message ID | 20210425230803.3055-1-goto@k-tech.co.jp |
|---|---|
| State | Accepted |
| Commit | b104caa9a497b7d6f3a3df3462f37bf92265e26f |
| Delegated to: | Tom Rini |
| Headers | show |
| Series | [v3] IOMUX: Fix buffer overflow in iomux_replace_device() | expand |
On Mon, Apr 26, 2021 at 08:08:03AM +0900, Yuichiro Goto wrote: > Use of strcat() against an uninitialized buffer would lead > to buffer overflow. This patch fixes it. Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> > Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()") > Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp> > Cc: Peter Robinson <pbrobinson@gmail.com> > Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> > Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> > --- > > Changes for v3: > - Add a Fixes tag in commit message > - Refactor the patch per suggestion from Andy Shevchenko > > Changes for v2: > - Add "IOMUX" in title > > common/iomux.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/common/iomux.c b/common/iomux.c > index b9088aa3b5..c428f7110a 100644 > --- a/common/iomux.c > +++ b/common/iomux.c > @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new) > return -ENOMEM; > } > > - strcat(tmp, ","); > - strcat(tmp, name); > + if (arg) { > + strcat(tmp, ","); > + strcat(tmp, name); > + } > + else > + strcpy(tmp, name); > > arg = tmp; > size = strlen(tmp) + 1; > -- > 2.17.1 >
On Mon, Apr 26, 2021 at 12:08 AM Yuichiro Goto <goto@k-tech.co.jp> wrote: > > Use of strcat() against an uninitialized buffer would lead > to buffer overflow. This patch fixes it. > > Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()") > Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp> > Cc: Peter Robinson <pbrobinson@gmail.com> > Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> > Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> Tested-by: Peter Robinson <pbrobinson@gmail.com> On a RPi2/RPi3 and Cubieboard > --- > > Changes for v3: > - Add a Fixes tag in commit message > - Refactor the patch per suggestion from Andy Shevchenko > > Changes for v2: > - Add "IOMUX" in title > > common/iomux.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/common/iomux.c b/common/iomux.c > index b9088aa3b5..c428f7110a 100644 > --- a/common/iomux.c > +++ b/common/iomux.c > @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new) > return -ENOMEM; > } > > - strcat(tmp, ","); > - strcat(tmp, name); > + if (arg) { > + strcat(tmp, ","); > + strcat(tmp, name); > + } > + else > + strcpy(tmp, name); > > arg = tmp; > size = strlen(tmp) + 1; > -- > 2.17.1 >
On Mon, Apr 26, 2021 at 08:08:03AM +0900, Yuichiro Goto wrote: > Use of strcat() against an uninitialized buffer would lead > to buffer overflow. This patch fixes it. > > Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()") > Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp> > Cc: Peter Robinson <pbrobinson@gmail.com> > Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> > Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> > Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> > Tested-by: Peter Robinson <pbrobinson@gmail.com> Applied to u-boot/master, thanks!
diff --git a/common/iomux.c b/common/iomux.c index b9088aa3b5..c428f7110a 100644 --- a/common/iomux.c +++ b/common/iomux.c @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new) return -ENOMEM; } - strcat(tmp, ","); - strcat(tmp, name); + if (arg) { + strcat(tmp, ","); + strcat(tmp, name); + } + else + strcpy(tmp, name); arg = tmp; size = strlen(tmp) + 1;
Use of strcat() against an uninitialized buffer would lead to buffer overflow. This patch fixes it. Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()") Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp> Cc: Peter Robinson <pbrobinson@gmail.com> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> --- Changes for v3: - Add a Fixes tag in commit message - Refactor the patch per suggestion from Andy Shevchenko Changes for v2: - Add "IOMUX" in title common/iomux.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)