As the function 'sprintf' does not check buffer boundaries but outputs to the buffer 'enet' of fixed size (16), this patch removes the function 'sprintf', and uses 'strcpy' instead. It will assign the character arrays 'enet' and 'phy' the corresponding character strings.

Signed-off-by: Alison Wang alison.wang@freescale.com --- arch/arm/cpu/armv7/ls102xa/fdt.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/arch/arm/cpu/armv7/ls102xa/fdt.c b/arch/arm/cpu/armv7/ls102xa/fdt.c index 71a1753..e01d911 100644 --- a/arch/arm/cpu/armv7/ls102xa/fdt.c +++ b/arch/arm/cpu/armv7/ls102xa/fdt.c @@ -29,29 +29,30 @@ void ft_fixup_enet_phy_connect_type(void *fdt) char phy[16]; int phy_node; int i = 0; - int enet_id = 0; uint32_t ph;

while ((dev = eth_get_dev_by_index(i++)) != NULL) { - if (strstr(dev->name, "eTSEC1")) - enet_id = 0; - else if (strstr(dev->name, "eTSEC2")) - enet_id = 1; - else if (strstr(dev->name, "eTSEC3")) - enet_id = 2; - else + if (strstr(dev->name, "eTSEC1")) { + strcpy(enet, "ethernet0"); + strcpy(phy, "enet0_rgmii_phy"); + } else if (strstr(dev->name, "eTSEC2")) { + strcpy(enet, "ethernet1"); + strcpy(phy, "enet1_rgmii_phy"); + } else if (strstr(dev->name, "eTSEC3")) { + strcpy(enet, "ethernet2"); + strcpy(phy, "enet2_rgmii_phy"); + } else { continue; + }

priv = dev->priv; if (priv->flags & TSEC_SGMII) continue;

- sprintf(enet, "ethernet%d", enet_id); enet_path = fdt_get_alias(fdt, enet); if (!enet_path) continue;

- sprintf(phy, "enet%d_rgmii_phy", enet_id); phy_path = fdt_get_alias(fdt, phy); if (!phy_path) continue;