buf is an array of size DFU_ALT_BUF_LEN bytes.
It is gradually filled with data using snprintf but the
size argument to snprintf is kept at DFU_ALT_BUF_LEN,
making it possible to overflow the buffer.
Fix this bug using the correct buffer size:
DFU_ALT_BUF_LEN - len.
Also, replace snprintf by scnprintf, otherwise len
variable is incremented incorrectly. It is now
incremented by the actual character count written
in buf.
v2: Replace snprintf by scnprintf
Signed-off-by: Francois Berder <[email protected]>
---
board/xilinx/versal/board.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/board/xilinx/versal/board.c b/board/xilinx/versal/board.c
index 9371c30ea27..88bcd692401 100644
--- a/board/xilinx/versal/board.c
+++ b/board/xilinx/versal/board.c
@@ -418,15 +418,15 @@ void configure_capsule_updates(void)
case SD_MODE1:
bootseq = mmc_get_env_dev();
- len += snprintf(buf + len, DFU_ALT_BUF_LEN, "mmc %d=boot",
- bootseq);
+ len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len, "mmc
%d=boot",
+ bootseq);
if (multiboot)
- len += snprintf(buf + len, DFU_ALT_BUF_LEN,
- "%04d", multiboot);
+ len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len,
+ "%04d", multiboot);
- len += snprintf(buf + len, DFU_ALT_BUF_LEN, ".bin fat %d 1",
- bootseq);
+ len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len, ".bin fat %d
1",
+ bootseq);
break;
case QSPI_MODE_24BIT:
case QSPI_MODE_32BIT:
@@ -438,9 +438,9 @@ void configure_capsule_updates(void)
mtd_found_part(&base, &limit);
- len += snprintf(buf + len, DFU_ALT_BUF_LEN,
- "sf 0:0=boot.bin raw 0x%x 0x%x",
- base, limit);
+ len += scnprintf(buf + len, DFU_ALT_BUF_LEN - len,
+ "sf 0:0=boot.bin raw 0x%x 0x%x",
+ base, limit);
}
break;
default:
--
2.43.0
