From mboxrd@z Thu Jan  1 00:00:00 1970
From: Mike Frysinger <vapier@gentoo.org>
Date: Wed, 19 Oct 2011 18:51:10 -0400
Subject: [U-Boot] [PATCH 3/4] bootm: Avoid 256-byte overflow in
	fixup_silent_linux()
In-Reply-To: <1319063459-4804-4-git-send-email-dianders@chromium.org>
References: <1319063459-4804-1-git-send-email-dianders@chromium.org>
	<1319063459-4804-4-git-send-email-dianders@chromium.org>
Message-ID: <201110191851.11038.vapier@gentoo.org>
List-Id: <u-boot.lists.denx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: u-boot@lists.denx.de

On Wednesday 19 October 2011 18:30:58 Doug Anderson wrote:
> --- a/common/cmd_bootm.c
> +++ b/common/cmd_bootm.c
>
> +static char *do_fixup_silent_linux(const char *cmdline)
> +{
> +	int bufsize;

size_t

> +	/*
> +	 * Allocate enough space for:
> +	 * - a copy of the command line
> +	 * - a space
> +	 * - a blank "console=" argument
> +	 * - the '\0'
> +	 *
> +	 * ...we might not need all this space, but it's OK to overallocate a
> +	 * little.
> +	 */
> +	bufsize = strlen(cmdline) + 1 + sizeof("console=");

relying on the sizeof() to include the NUL byte calculation seems like it 
could confuse some.  how about:
	strlen(cmdline) + 1 + strlen("console=") + 1;
gcc should optimize that into a constant anyways.

> +	strcpy(buf, cmdline);
> +	do {
> +		did_remove  = remove_cmdline_param(buf, "console");
> +	} while (did_remove);
> +	add_cmdline_param(buf, "console=", bufsize);

this is different behavior from what was there before.  the previous code only 
removed the first console= and not all of them.  i've relied on this behavior 
in the past, so i'm not sure you should change it.  at least not without a 
dedicated commit rather than merging it with a commit that's supposed to just 
change the code to use the new remove_cmdline_param() helper.
-mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
Url : http://lists.denx.de/pipermail/u-boot/attachments/20111019/d74723ed/attachment.pgp