From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Nelson <eric.nelson@boundarydevices.com>
Date: Wed, 01 Oct 2014 14:23:51 -0700
Subject: [U-Boot] [PATCH 3/3] usb: gadget: fastboot: terminate commands
	with NULL
In-Reply-To: <542C66C2.20800@broadcom.com>
References: <1412103942-28331-1-git-send-email-eric.nelson@boundarydevices.com>
	<1412103942-28331-4-git-send-email-eric.nelson@boundarydevices.com>
	<542C66C2.20800@broadcom.com>
Message-ID: <542C70E7.6040802@boundarydevices.com>
List-Id: <u-boot.lists.denx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: u-boot@lists.denx.de

Thanks Steve,

On 10/01/2014 01:40 PM, Steve Rae wrote:
> 
> 
> On 14-09-30 12:05 PM, Eric Nelson wrote:
>> Without NULL termination, various commands will read past the
>> end of input. In particular, this was noticed with error()
>> calls in cb_getvar and simple_strtoul() in cb_download.
>>
>> Since the download callback happens elsewhere, the 4k buffer
>> should always be sufficient to handle command arguments.
>>
>> Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
>> ---
>>   drivers/usb/gadget/f_fastboot.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/drivers/usb/gadget/f_fastboot.c
>> b/drivers/usb/gadget/f_fastboot.c
>> index 86700f5..0950ea8 100644
>> --- a/drivers/usb/gadget/f_fastboot.c
>> +++ b/drivers/usb/gadget/f_fastboot.c
>> @@ -542,6 +542,13 @@ static void rx_handler_command(struct usb_ep *ep,
>> struct usb_request *req)
>>           error("unknown command: %s\n", cmdbuf);
>>           fastboot_tx_write_str("FAILunknown command");
>>       } else {
>> +        if (req->actual < req->length) {
>> +            u8 *buf = (u8 *)req->buf;
>> +            buf[req->actual] = 0;
>> +            func_cb(ep, req);
>> +        } else {
>> +            error("buffer overflow\n");
>                         fastboot_tx_write_str("FAILbuffer overflow");
> ADD this line
>> +        }
>>           func_cb(ep, req);
> AND delete this line (otherwise the func_cb() is called twice!!!)
>>       }
>>

Ouch. It appears I pooched the patch when trying to make checkpatch
happy with the extra(neous) braces.

I'll forward V2 shortly.

Regards,


Eric