| Message ID | 20221126125753.81323-1-marex@denx.de |
|---|---|
| State | Accepted |
| Delegated to: | Marek Vasut |
| Headers | show |
| Series | usb: Expand buffer size in usb_find_and_bind_driver() | expand |
On Sun, 27 Nov 2022 at 01:58, Marek Vasut <marex@denx.de> wrote: > > The "generic_bus_%x_dev_%x" string which is printed into this buffer > can be up to 34 characters long ("generic_bus_12345678_dev_12345678"). > The buffer would be clipped by snprintf() if both %x were at maximum > range. Make sure the buffer is long enough to cover such possibility. > > Signed-off-by: Marek Vasut <marex@denx.de> > --- > Cc: Sean Anderson <sean.anderson@seco.com> > Cc: Simon Glass <sjg@chromium.org> > --- > drivers/usb/host/usb-uclass.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > Reviewed-by: Simon Glass <sjg@chromium.org>
diff --git a/drivers/usb/host/usb-uclass.c b/drivers/usb/host/usb-uclass.c index 27e2fc6fcd3..060f3441df0 100644 --- a/drivers/usb/host/usb-uclass.c +++ b/drivers/usb/host/usb-uclass.c @@ -557,7 +557,7 @@ static int usb_find_and_bind_driver(struct udevice *parent, struct usb_driver_entry *start, *entry; int n_ents; int ret; - char name[30], *str; + char name[34], *str; ofnode node = usb_get_ofnode(parent, port); *devp = NULL;
The "generic_bus_%x_dev_%x" string which is printed into this buffer can be up to 34 characters long ("generic_bus_12345678_dev_12345678"). The buffer would be clipped by snprintf() if both %x were at maximum range. Make sure the buffer is long enough to cover such possibility. Signed-off-by: Marek Vasut <marex@denx.de> --- Cc: Sean Anderson <sean.anderson@seco.com> Cc: Simon Glass <sjg@chromium.org> --- drivers/usb/host/usb-uclass.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)