From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Rae Date: Wed, 1 Oct 2014 13:40:34 -0700 Subject: [U-Boot] [PATCH 3/3] usb: gadget: fastboot: terminate commands with NULL In-Reply-To: <1412103942-28331-4-git-send-email-eric.nelson@boundarydevices.com> References: <1412103942-28331-1-git-send-email-eric.nelson@boundarydevices.com> <1412103942-28331-4-git-send-email-eric.nelson@boundarydevices.com> Message-ID: <542C66C2.20800@broadcom.com> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de On 14-09-30 12:05 PM, Eric Nelson wrote: > Without NULL termination, various commands will read past the > end of input. In particular, this was noticed with error() > calls in cb_getvar and simple_strtoul() in cb_download. > > Since the download callback happens elsewhere, the 4k buffer > should always be sufficient to handle command arguments. > > Signed-off-by: Eric Nelson > --- > drivers/usb/gadget/f_fastboot.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c > index 86700f5..0950ea8 100644 > --- a/drivers/usb/gadget/f_fastboot.c > +++ b/drivers/usb/gadget/f_fastboot.c > @@ -542,6 +542,13 @@ static void rx_handler_command(struct usb_ep *ep, struct usb_request *req) > error("unknown command: %s\n", cmdbuf); > fastboot_tx_write_str("FAILunknown command"); > } else { > + if (req->actual < req->length) { > + u8 *buf = (u8 *)req->buf; > + buf[req->actual] = 0; > + func_cb(ep, req); > + } else { > + error("buffer overflow\n"); fastboot_tx_write_str("FAILbuffer overflow"); ADD this line > + } > func_cb(ep, req); AND delete this line (otherwise the func_cb() is called twice!!!) > } > > I have not experienced this issue, however, if it is to be accepted, then please update these two lines.... Afterwards: Tested-by: Steve Rae