In case the filename is too long, longer than PATH_MAX - 1, it
would overflow dirs->dirname array. Add missing check and also
use strncpy() to prevent the overflow in any case.

Fixes CID 550305:  Security best practices violations  (STRING_OVERFLOW)

Signed-off-by: Marek Vasut <ma...@denx.de>
---
Cc: Tom Rini <tr...@konsulko.com>
Cc: u-boot@lists.denx.de
---
 fs/exfat/io.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/exfat/io.c b/fs/exfat/io.c
index c56f5675987..77cd2dfb6dc 100644
--- a/fs/exfat/io.c
+++ b/fs/exfat/io.c
@@ -720,6 +720,9 @@ int exfat_fs_opendir(const char *filename, struct 
fs_dir_stream **dirsp)
        struct exfat_node *dnode;
        int err;
 
+       if (strlen(filename) >= PATH_MAX)
+               return -ENAMETOOLONG;
+
        err = exfat_lookup_realpath(&ctxt.ef, &dnode, filename);
        if (err)
                return err;
@@ -736,7 +739,7 @@ int exfat_fs_opendir(const char *filename, struct 
fs_dir_stream **dirsp)
        if (!dirs)
                return -ENOMEM;
 
-       strcpy(dirs->dirname, filename);
+       strncpy(dirs->dirname, filename, PATH_MAX - 1);
        dirs->offset = -1;
 
        *dirsp = &dirs->fs_dirs;
-- 
2.47.2

Reply via email to