brain-hackers_pepepper-mirror/u-boot-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/u-boot-brain synced 2024-09-27 23:20:26 +09:00
Code Issues Projects Releases Wiki Activity

mtd: Make sure the name passed in mtdparts fits in mtd_name[]

Browse Source 
The local mtd_name[] variable is limited in size. Return an error if
the name passed in mtdparts does not fit in this local var.

Fixes: 5db66b3aee ("cmd: mtd: add 'mtd' command")
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Tested-by: Heiko Schocher <hs@denx.de>
This commit is contained in:
Boris Brezillon 2018-12-02 10:54:28 +01:00 committed by Jagan Teki
parent 429e048e41
commit 772aa97993
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/mtd/mtd_uboot.c
View File

@ -222,8 +222,8 @@ int mtd_probe_devices(void)
while (mtdparts[0] != '\0') {
char mtd_name[MTD_NAME_MAX_LEN], *colon;
struct mtd_partition *parts;
int mtd_name_len, nparts;
int ret;
unsigned int mtd_name_len;
int nparts, ret;
colon = strchr(mtdparts, ':');
if (!colon) {
@ -231,7 +231,12 @@ int mtd_probe_devices(void)
return -EINVAL;
}
mtd_name_len = colon - mtdparts;
mtd_name_len = (unsigned int)(colon - mtdparts);
if (mtd_name_len + 1 > sizeof(mtd_name)) {
printf("MTD name too long: %s\n", mtdparts);
return -EINVAL;
}
strncpy(mtd_name, mtdparts, mtd_name_len);
mtd_name[mtd_name_len] = '\0';
/* Move the pointer forward (including the ':') */