diff mbox

[U-Boot] Fix GCC format-security errors.

Message ID 1451399667-32519-1-git-send-email-ben.whitten@gmail.com
State Changes Requested
Delegated to: Wolfgang Denk
Headers show

Commit Message

Ben Whitten Dec. 29, 2015, 2:34 p.m. UTC 
From: Ben Whitten <ben.whitten@gmail.com>

With format-security errors turned on, GCC picks up the use of sprintf without
a format parameter.

Signed-off-by: Ben Whitten <ben.whitten@gmail.com>
---
 common/cmd_elf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--
2.6.4

Comments

Wolfgang Denk Dec. 29, 2015, 4:11 p.m. UTC | #1 
Dear Ben,

In message <1451399667-32519-1-git-send-email-ben.whitten@gmail.com> you wrote:
> From: Ben Whitten <ben.whitten@gmail.com>
> 
> With format-security errors turned on, GCC picks up the use of sprintf without
> a format parameter.

Thanks for detecting this, but...

> -				ptr = sprintf(build_buf, tmp);
> +				ptr = sprintf(build_buf, "%s", tmp);
...
> -				ptr += sprintf(build_buf + ptr, tmp);
> +				ptr += sprintf(build_buf + ptr, "%s", tmp);

... why should we use sprintf() here at all?  I recommend to convert
this into a plain strcpy().

Best regards,

Wolfgang Denk
diff mbox

Patch

diff --git a/common/cmd_elf.c b/common/cmd_elf.c
index 86e694a..3677702 100644
--- a/common/cmd_elf.c
+++ b/common/cmd_elf.c
@@ -289,7 +289,7 @@  int do_bootvx(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 		} else {
 			tmp = getenv("bootdev");
 			if (tmp)
-				ptr = sprintf(build_buf, tmp);
+				ptr = sprintf(build_buf, "%s", tmp);
 			else
 				printf("## VxWorks boot device not specified\n");

@@ -332,7 +332,7 @@  int do_bootvx(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])

 			tmp = getenv("othbootargs");
 			if (tmp)
-				ptr += sprintf(build_buf + ptr, tmp);
+				ptr += sprintf(build_buf + ptr, "%s", tmp);

 			memcpy((void *)bootaddr, build_buf,
 			       max(strlen(build_buf), (size_t)255));