From patchwork Sun Jul 30 20:18:18 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heinrich Schuchardt X-Patchwork-Id: 795430 X-Patchwork-Delegate: monstr@monstr.eu Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.denx.de (client-ip=81.169.180.215; helo=lists.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Received: from lists.denx.de (dione.denx.de [81.169.180.215]) by ozlabs.org (Postfix) with ESMTP id 3xLDS25tvBz9s83 for ; Mon, 31 Jul 2017 06:18:41 +1000 (AEST) Received: by lists.denx.de (Postfix, from userid 105) id 4D49BC21F00; Sun, 30 Jul 2017 20:18:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=-0.7 required=5.0 tests=FREEMAIL_FROM, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id 16F72C21D99; Sun, 30 Jul 2017 20:18:35 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id 81C75C21D99; Sun, 30 Jul 2017 20:18:33 +0000 (UTC) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) by lists.denx.de (Postfix) with ESMTPS id 315EEC21D8D for ; Sun, 30 Jul 2017 20:18:29 +0000 (UTC) Received: from LT002.fritz.box ([84.118.154.110]) by mail.gmx.com (mrgmx103 [212.227.17.168]) with ESMTPSA (Nemesis) id 0MGip3-1dOw6q0XuT-00DZZ6; Sun, 30 Jul 2017 22:18:25 +0200 From: Heinrich Schuchardt To: Michal Simek Date: Sun, 30 Jul 2017 22:18:18 +0200 Message-Id: <20170730201818.22460-1-xypron.glpk@gmx.de> X-Mailer: git-send-email 2.11.0 X-Provags-ID: V03:K0:QbEAd3BFz9GrdzRu3QayvW6RL9hsAExTYtAn42UN0po2UBhEkWY pnMWLUaDjc8cCCdqsNCwDLHqkve3VgXDdIw4phAnkjgZspNMaDNt0IsNjC6ckH9JKs2CMan s+UovVysh/VXiWN5DA4WnT4sCbFfpuMPlxFSSTbgd+UW+GLO2snD8DEiEBlWYTeciWwY+r/ 8Yv9gc1KUIPebCZZOQcMQ== X-UI-Out-Filterresults: notjunk:1; V01:K0:RQ3V7XhAtY4=:5banxPOcfdqTGyJK0VHeH3 j4xA4Mt8ecJkDVhPGIJljtKhMJ02OHa0ubzW8dCc7Om4iGW5Ywqj7XVCy2mqRCHU/Usp0McP/ 4XqVq7elVbrsAvBjJbYRYmkSzV+WzgqlwVJmz/wstsT5BPrVOB4fwhr35JLLI4Uq3wcE7lo1P DdzY0r2iskPKlJ1ACzLnaAwYARDYdBzIvHCprCYg8rYkZI+0ukNXvv9+pbcCtMWSdlNKm1fts yplNYEeqCVnToC6MfhdjfWvcEd4J1fICdOP/aKpkKfN19Le0oYQh+BW66BCLBsIx5N1qiAfjJ 4Lr6KmrONnNgFuyJ9OBhS9Jqa6u3yrYTR3QYtalEwp9F/0l0Lirg7+wtQOOFV8sbkwPhPgxRO xMCPQ1wQa+5pd0p60jSOtUHfdOTcrEWr5HBjUlvCeMx59IgeJebxqGRIGY/gkhwkNVVBrZexe 0CdpFtV17teKhtL4ESl0kskwMYYoRDU1o0FqWmuliRztA2XACcESLTNkEd0fovsttJSJZgzu/ M4muIudi8mv5HYIs6XRYooI+O4e8e3ZcxA6NDiby1qAjpJLCTQsR7q8rpXJ8wF2UhjL55ArQI HehqhGkyHsTvo96lIGiuu/UqvtIDXEnElZzExMKAMB+0imnYhOCUOEr4rsAtDsCYsjCxZR0kS dil0RpnZH6h2SbhWxHSKKWUTpCrZEjQa4v5ykeJfOMi/U3uUk4Z6y9X9+fX+s0P6fF7ybhp1K lgtZLsojSctGYpoEpzOmVZaqV7IlKBUkHRDW/MIwburBuVHQCCg0U5BhLZKREZSkRIglw4tL+ 3i04niMDd8uFjDIWJLc4OI4FA7WgQ== Cc: u-boot@lists.denx.de, Heinrich Schuchardt Subject: [U-Boot] [PATCH 1/1] ARM64: zynqmp: avoid out of buffer access X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" strncat(a, b, c) appends a maximum of c characters plus the 0 byte to a. In board_init we first write 4 characters plus 0 byte to version. So only ZYNQMP_VERSION_SIZE - 5 additional characters fit into version. The problem was indicated by cppcheck. Signed-off-by: Heinrich Schuchardt --- board/xilinx/zynqmp/zynqmp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c index 51a3d9f276..bbcab9869e 100644 --- a/board/xilinx/zynqmp/zynqmp.c +++ b/board/xilinx/zynqmp/zynqmp.c @@ -133,10 +133,10 @@ int board_init(void) if (current_el() != 3) { static char version[ZYNQMP_VERSION_SIZE]; - strncat(version, "xczu", ZYNQMP_VERSION_SIZE); + strncat(version, "xczu", 4); zynqmppl.name = strncat(version, zynqmp_get_silicon_idcode_name(), - ZYNQMP_VERSION_SIZE); + ZYNQMP_VERSION_SIZE - 5); printf("Chip ID:\t%s\n", zynqmppl.name); fpga_init(); fpga_add(fpga_xilinx, &zynqmppl);