[PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()

[PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()

[Yuichiro Goto]

Use of strcat() against an uninitialized buffer would lead
to buffer overflow. This patch fixes it.

Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
Cc: Peter Robinson <pbrobinson@gmail.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
---

Changes for v3:
- Add a Fixes tag in commit message
- Refactor the patch per suggestion from Andy Shevchenko

Changes for v2:
- Add "IOMUX" in title

 common/iomux.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/common/iomux.c b/common/iomux.c
index b9088aa3b5..c428f7110a 100644
--- a/common/iomux.c
+++ b/common/iomux.c
@@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new)
 			return -ENOMEM;
 		}
 
-		strcat(tmp, ",");
-		strcat(tmp, name);
+		if (arg) {
+			strcat(tmp, ",");
+			strcat(tmp, name);
+		}
+		else
+			strcpy(tmp, name);
 
 		arg = tmp;
 		size = strlen(tmp) + 1;
-- 
2.17.1

[PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()

[Andy Shevchenko]

On Mon, Apr 26, 2021 at 08:08:03AM +0900, Yuichiro Goto wrote:
> Use of strcat() against an uninitialized buffer would lead
> to buffer overflow. This patch fixes it.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

> Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
> Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
> Cc: Peter Robinson <pbrobinson@gmail.com>
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
> ---
> 
> Changes for v3:
> - Add a Fixes tag in commit message
> - Refactor the patch per suggestion from Andy Shevchenko
> 
> Changes for v2:
> - Add "IOMUX" in title
> 
>  common/iomux.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/common/iomux.c b/common/iomux.c
> index b9088aa3b5..c428f7110a 100644
> --- a/common/iomux.c
> +++ b/common/iomux.c
> @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new)
>  			return -ENOMEM;
>  		}
>  
> -		strcat(tmp, ",");
> -		strcat(tmp, name);
> +		if (arg) {
> +			strcat(tmp, ",");
> +			strcat(tmp, name);
> +		}
> +		else
> +			strcpy(tmp, name);
>  
>  		arg = tmp;
>  		size = strlen(tmp) + 1;
> -- 
> 2.17.1
> 

-- 
With Best Regards,
Andy Shevchenko

[PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()

[Peter Robinson]

On Mon, Apr 26, 2021 at 12:08 AM Yuichiro Goto <goto@k-tech.co.jp> wrote:
>
> Use of strcat() against an uninitialized buffer would lead
> to buffer overflow. This patch fixes it.
>
> Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
> Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
> Cc: Peter Robinson <pbrobinson@gmail.com>
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>

Tested-by: Peter Robinson <pbrobinson@gmail.com>
On a RPi2/RPi3 and Cubieboard

> ---
>
> Changes for v3:
> - Add a Fixes tag in commit message
> - Refactor the patch per suggestion from Andy Shevchenko
>
> Changes for v2:
> - Add "IOMUX" in title
>
>  common/iomux.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/common/iomux.c b/common/iomux.c
> index b9088aa3b5..c428f7110a 100644
> --- a/common/iomux.c
> +++ b/common/iomux.c
> @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new)
>                         return -ENOMEM;
>                 }
>
> -               strcat(tmp, ",");
> -               strcat(tmp, name);
> +               if (arg) {
> +                       strcat(tmp, ",");
> +                       strcat(tmp, name);
> +               }
> +               else
> +                       strcpy(tmp, name);
>
>                 arg = tmp;
>                 size = strlen(tmp) + 1;
> --
> 2.17.1
>

[PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()

[Tom Rini]

On Mon, Apr 26, 2021 at 08:08:03AM +0900, Yuichiro Goto wrote:

> Use of strcat() against an uninitialized buffer would lead
> to buffer overflow. This patch fixes it.
> 
> Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
> Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
> Cc: Peter Robinson <pbrobinson@gmail.com>
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Tested-by: Peter Robinson <pbrobinson@gmail.com>

Applied to u-boot/master, thanks!

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20210427/1776de39/attachment.sig>