* [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()
@ 2021-04-25 23:08 Yuichiro Goto
2021-04-26 8:35 ` Andy Shevchenko
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Yuichiro Goto @ 2021-04-25 23:08 UTC (permalink / raw)
To: u-boot
Use of strcat() against an uninitialized buffer would lead
to buffer overflow. This patch fixes it.
Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
Cc: Peter Robinson <pbrobinson@gmail.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
---
Changes for v3:
- Add a Fixes tag in commit message
- Refactor the patch per suggestion from Andy Shevchenko
Changes for v2:
- Add "IOMUX" in title
common/iomux.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/common/iomux.c b/common/iomux.c
index b9088aa3b5..c428f7110a 100644
--- a/common/iomux.c
+++ b/common/iomux.c
@@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new)
return -ENOMEM;
}
- strcat(tmp, ",");
- strcat(tmp, name);
+ if (arg) {
+ strcat(tmp, ",");
+ strcat(tmp, name);
+ }
+ else
+ strcpy(tmp, name);
arg = tmp;
size = strlen(tmp) + 1;
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()
2021-04-25 23:08 [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device() Yuichiro Goto
@ 2021-04-26 8:35 ` Andy Shevchenko
2021-04-27 8:44 ` Peter Robinson
2021-04-27 16:46 ` Tom Rini
2 siblings, 0 replies; 4+ messages in thread
From: Andy Shevchenko @ 2021-04-26 8:35 UTC (permalink / raw)
To: u-boot
On Mon, Apr 26, 2021 at 08:08:03AM +0900, Yuichiro Goto wrote:
> Use of strcat() against an uninitialized buffer would lead
> to buffer overflow. This patch fixes it.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
> Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
> Cc: Peter Robinson <pbrobinson@gmail.com>
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
> ---
>
> Changes for v3:
> - Add a Fixes tag in commit message
> - Refactor the patch per suggestion from Andy Shevchenko
>
> Changes for v2:
> - Add "IOMUX" in title
>
> common/iomux.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/common/iomux.c b/common/iomux.c
> index b9088aa3b5..c428f7110a 100644
> --- a/common/iomux.c
> +++ b/common/iomux.c
> @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new)
> return -ENOMEM;
> }
>
> - strcat(tmp, ",");
> - strcat(tmp, name);
> + if (arg) {
> + strcat(tmp, ",");
> + strcat(tmp, name);
> + }
> + else
> + strcpy(tmp, name);
>
> arg = tmp;
> size = strlen(tmp) + 1;
> --
> 2.17.1
>
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()
2021-04-25 23:08 [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device() Yuichiro Goto
2021-04-26 8:35 ` Andy Shevchenko
@ 2021-04-27 8:44 ` Peter Robinson
2021-04-27 16:46 ` Tom Rini
2 siblings, 0 replies; 4+ messages in thread
From: Peter Robinson @ 2021-04-27 8:44 UTC (permalink / raw)
To: u-boot
On Mon, Apr 26, 2021 at 12:08 AM Yuichiro Goto <goto@k-tech.co.jp> wrote:
>
> Use of strcat() against an uninitialized buffer would lead
> to buffer overflow. This patch fixes it.
>
> Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
> Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
> Cc: Peter Robinson <pbrobinson@gmail.com>
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
On a RPi2/RPi3 and Cubieboard
> ---
>
> Changes for v3:
> - Add a Fixes tag in commit message
> - Refactor the patch per suggestion from Andy Shevchenko
>
> Changes for v2:
> - Add "IOMUX" in title
>
> common/iomux.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/common/iomux.c b/common/iomux.c
> index b9088aa3b5..c428f7110a 100644
> --- a/common/iomux.c
> +++ b/common/iomux.c
> @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new)
> return -ENOMEM;
> }
>
> - strcat(tmp, ",");
> - strcat(tmp, name);
> + if (arg) {
> + strcat(tmp, ",");
> + strcat(tmp, name);
> + }
> + else
> + strcpy(tmp, name);
>
> arg = tmp;
> size = strlen(tmp) + 1;
> --
> 2.17.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()
2021-04-25 23:08 [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device() Yuichiro Goto
2021-04-26 8:35 ` Andy Shevchenko
2021-04-27 8:44 ` Peter Robinson
@ 2021-04-27 16:46 ` Tom Rini
2 siblings, 0 replies; 4+ messages in thread
From: Tom Rini @ 2021-04-27 16:46 UTC (permalink / raw)
To: u-boot
On Mon, Apr 26, 2021 at 08:08:03AM +0900, Yuichiro Goto wrote:
> Use of strcat() against an uninitialized buffer would lead
> to buffer overflow. This patch fixes it.
>
> Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
> Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
> Cc: Peter Robinson <pbrobinson@gmail.com>
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Tested-by: Peter Robinson <pbrobinson@gmail.com>
Applied to u-boot/master, thanks!
--
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20210427/1776de39/attachment.sig>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-04-27 16:46 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-04-25 23:08 [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device() Yuichiro Goto
2021-04-26 8:35 ` Andy Shevchenko
2021-04-27 8:44 ` Peter Robinson
2021-04-27 16:46 ` Tom Rini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox