Re: [PATCH v3] IOMUX: Fix buffer overflow in iomux_replace_device()

27 Apr 2021

On Mon, Apr 26, 2021 at 12:08 AM Yuichiro Goto goto@k-tech.co.jp wrote:
...
Use of strcat() against an uninitialized buffer would lead
to buffer overflow. This patch fixes it.
Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()")
Signed-off-by: Yuichiro Goto goto@k-tech.co.jp
Cc: Peter Robinson pbrobinson@gmail.com
Cc: Andy Shevchenko andriy.shevchenko@linux.intel.com
Cc: Nicolas Saenz Julienne nsaenzjulienne@suse.de
Tested-by: Peter Robinson pbrobinson@gmail.com
On a RPi2/RPi3 and Cubieboard
...

Changes for v3:

Add a Fixes tag in commit message
Refactor the patch per suggestion from Andy Shevchenko

Changes for v2:

Add "IOMUX" in title

common/iomux.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/common/iomux.c b/common/iomux.c
index b9088aa3b5..c428f7110a 100644
--- a/common/iomux.c
+++ b/common/iomux.c
@@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new)
                        return -ENOMEM;
                }

          strcat(tmp, ",");


          strcat(tmp, name);




          if (arg) {


                  strcat(tmp, ",");


                  strcat(tmp, name);


          }


          else


                  strcpy(tmp, name);

          arg = tmp;
          size = strlen(tmp) + 1;



--
2.17.1

    