Fix an off-by-one error in the string concatenation for the setevn command which would write over the end of the allocated area, resulting eventually in a crash due to corruption of the malloc metadata.
Signed-off-by: Wolfgang Denk wd@denx.de --- Posted as incremental patch here to provide quick fix to testers (also pushed to "hashtable" branch in u-boot-testing repo. Will be squashed into new env code patch when resubmitting.
common/cmd_nvedit.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/common/cmd_nvedit.c b/common/cmd_nvedit.c index 976a30b..010d003 100644 --- a/common/cmd_nvedit.c +++ b/common/cmd_nvedit.c @@ -273,7 +273,7 @@ int _do_env_set (int flag, int argc, char * const argv[]) /* * Insert / replace new value */ - for (i=2,len=1; i<argc; ++i) { + for (i=2,len=0; i<argc; ++i) { len += strlen(argv[i]) + 1; } if ((value = malloc(len)) == NULL) { @@ -285,7 +285,7 @@ int _do_env_set (int flag, int argc, char * const argv[])
while ((*s++ = *v++) != '\0') ; - *s++ = ' '; + *(s-1) = ' '; } if (s != value) *--s = '\0';