diff options
| author | Boris Brezillon <boris.brezillon@bootlin.com> | 2018-12-02 10:54:28 +0100 |
|---|---|---|
| committer | Jagan Teki <jagan@amarulasolutions.com> | 2018-12-06 00:45:36 +0530 |
| commit | 772aa9799353d1d6bd6d9e2682945d4d7122539a (patch) | |
| tree | 64a94f9703030b27dc035d31ca7642d15a325976 /drivers | |
| parent | 429e048e4190b68b078c37c0012c59804e32818b (diff) | |
mtd: Make sure the name passed in mtdparts fits in mtd_name[]
The local mtd_name[] variable is limited in size. Return an error if
the name passed in mtdparts does not fit in this local var.
Fixes: 5db66b3aee6f ("cmd: mtd: add 'mtd' command")
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Tested-by: Heiko Schocher <hs@denx.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/mtd/mtd_uboot.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/mtd/mtd_uboot.c b/drivers/mtd/mtd_uboot.c index d551aee202..0eda362783 100644 --- a/drivers/mtd/mtd_uboot.c +++ b/drivers/mtd/mtd_uboot.c @@ -222,8 +222,8 @@ int mtd_probe_devices(void) while (mtdparts[0] != '\0') { char mtd_name[MTD_NAME_MAX_LEN], *colon; struct mtd_partition *parts; - int mtd_name_len, nparts; - int ret; + unsigned int mtd_name_len; + int nparts, ret; colon = strchr(mtdparts, ':'); if (!colon) { @@ -231,7 +231,12 @@ int mtd_probe_devices(void) return -EINVAL; } - mtd_name_len = colon - mtdparts; + mtd_name_len = (unsigned int)(colon - mtdparts); + if (mtd_name_len + 1 > sizeof(mtd_name)) { + printf("MTD name too long: %s\n", mtdparts); + return -EINVAL; + } + strncpy(mtd_name, mtdparts, mtd_name_len); mtd_name[mtd_name_len] = '\0'; /* Move the pointer forward (including the ':') */ |