Use of strcat() against an uninitialized buffer would lead to buffer overflow. This patch fixes it.
Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()") Signed-off-by: Yuichiro Goto <g...@k-tech.co.jp> Cc: Peter Robinson <pbrobin...@gmail.com> Cc: Andy Shevchenko <andriy.shevche...@linux.intel.com> Cc: Nicolas Saenz Julienne <nsaenzjulie...@suse.de> --- Changes for v3: - Add a Fixes tag in commit message - Refactor the patch per suggestion from Andy Shevchenko Changes for v2: - Add "IOMUX" in title common/iomux.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/common/iomux.c b/common/iomux.c index b9088aa3b5..c428f7110a 100644 --- a/common/iomux.c +++ b/common/iomux.c @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new) return -ENOMEM; } - strcat(tmp, ","); - strcat(tmp, name); + if (arg) { + strcat(tmp, ","); + strcat(tmp, name); + } + else + strcpy(tmp, name); arg = tmp; size = strlen(tmp) + 1; -- 2.17.1