diff mbox

[U-Boot,1/1] ARM64: zynqmp: avoid out of buffer access

Message ID 20170730201818.22460-1-xypron.glpk@gmx.de
State Accepted
Commit df1cd46fb84922735e1c12f54b7202b0268dcddd
Delegated to: Michal Simek
Headers show

Commit Message

Heinrich Schuchardt July 30, 2017, 8:18 p.m. UTC 
strncat(a, b, c) appends a maximum of c characters plus the 0 byte
to a.

In board_init we first write 4 characters plus 0 byte to version.
So only ZYNQMP_VERSION_SIZE - 5 additional characters fit into
version.

The problem was indicated by cppcheck.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 board/xilinx/zynqmp/zynqmp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Michal Simek July 31, 2017, 8:30 a.m. UTC | #1 
On 30.7.2017 22:18, Heinrich Schuchardt wrote:
> strncat(a, b, c) appends a maximum of c characters plus the 0 byte
> to a.
> 
> In board_init we first write 4 characters plus 0 byte to version.
> So only ZYNQMP_VERSION_SIZE - 5 additional characters fit into
> version.
> 
> The problem was indicated by cppcheck.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> ---
>  board/xilinx/zynqmp/zynqmp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c
> index 51a3d9f276..bbcab9869e 100644
> --- a/board/xilinx/zynqmp/zynqmp.c
> +++ b/board/xilinx/zynqmp/zynqmp.c
> @@ -133,10 +133,10 @@ int board_init(void)
>  	if (current_el() != 3) {
>  		static char version[ZYNQMP_VERSION_SIZE];
>  
> -		strncat(version, "xczu", ZYNQMP_VERSION_SIZE);
> +		strncat(version, "xczu", 4);
>  		zynqmppl.name = strncat(version,
>  					zynqmp_get_silicon_idcode_name(),
> -					ZYNQMP_VERSION_SIZE);
> +					ZYNQMP_VERSION_SIZE - 5);
>  		printf("Chip ID:\t%s\n", zynqmppl.name);
>  		fpga_init();
>  		fpga_add(fpga_xilinx, &zynqmppl);
> 

Applied.

Thanks,
Michal
Michal Simek July 31, 2017, 8:33 a.m. UTC | #2 
On 30.7.2017 22:18, Heinrich Schuchardt wrote:
> strncat(a, b, c) appends a maximum of c characters plus the 0 byte
> to a.
> 
> In board_init we first write 4 characters plus 0 byte to version.
> So only ZYNQMP_VERSION_SIZE - 5 additional characters fit into
> version.
> 
> The problem was indicated by cppcheck.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> ---
>  board/xilinx/zynqmp/zynqmp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c
> index 51a3d9f276..bbcab9869e 100644
> --- a/board/xilinx/zynqmp/zynqmp.c
> +++ b/board/xilinx/zynqmp/zynqmp.c
> @@ -133,10 +133,10 @@ int board_init(void)
>  	if (current_el() != 3) {
>  		static char version[ZYNQMP_VERSION_SIZE];
>  
> -		strncat(version, "xczu", ZYNQMP_VERSION_SIZE);
> +		strncat(version, "xczu", 4);
>  		zynqmppl.name = strncat(version,
>  					zynqmp_get_silicon_idcode_name(),
> -					ZYNQMP_VERSION_SIZE);
> +					ZYNQMP_VERSION_SIZE - 5);
>  		printf("Chip ID:\t%s\n", zynqmppl.name);
>  		fpga_init();
>  		fpga_add(fpga_xilinx, &zynqmppl);
> 

Applied.

Thanks,
Michal
Michal Simek July 31, 2017, 8:33 a.m. UTC | #3 
On 30.7.2017 22:18, Heinrich Schuchardt wrote:
> strncat(a, b, c) appends a maximum of c characters plus the 0 byte
> to a.
> 
> In board_init we first write 4 characters plus 0 byte to version.
> So only ZYNQMP_VERSION_SIZE - 5 additional characters fit into
> version.
> 
> The problem was indicated by cppcheck.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> ---
>  board/xilinx/zynqmp/zynqmp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c
> index 51a3d9f276..bbcab9869e 100644
> --- a/board/xilinx/zynqmp/zynqmp.c
> +++ b/board/xilinx/zynqmp/zynqmp.c
> @@ -133,10 +133,10 @@ int board_init(void)
>  	if (current_el() != 3) {
>  		static char version[ZYNQMP_VERSION_SIZE];
>  
> -		strncat(version, "xczu", ZYNQMP_VERSION_SIZE);
> +		strncat(version, "xczu", 4);
>  		zynqmppl.name = strncat(version,
>  					zynqmp_get_silicon_idcode_name(),
> -					ZYNQMP_VERSION_SIZE);
> +					ZYNQMP_VERSION_SIZE - 5);
>  		printf("Chip ID:\t%s\n", zynqmppl.name);
>  		fpga_init();
>  		fpga_add(fpga_xilinx, &zynqmppl);
> 

Applied.

Thanks,
Michal
diff mbox

Patch

diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c
index 51a3d9f276..bbcab9869e 100644
--- a/board/xilinx/zynqmp/zynqmp.c
+++ b/board/xilinx/zynqmp/zynqmp.c
@@ -133,10 +133,10 @@  int board_init(void)
 	if (current_el() != 3) {
 		static char version[ZYNQMP_VERSION_SIZE];
 
-		strncat(version, "xczu", ZYNQMP_VERSION_SIZE);
+		strncat(version, "xczu", 4);
 		zynqmppl.name = strncat(version,
 					zynqmp_get_silicon_idcode_name(),
-					ZYNQMP_VERSION_SIZE);
+					ZYNQMP_VERSION_SIZE - 5);
 		printf("Chip ID:\t%s\n", zynqmppl.name);
 		fpga_init();
 		fpga_add(fpga_xilinx, &zynqmppl);