The "generic_bus_%x_dev_%x" string which is printed into this buffer can be up to 34 characters long ("generic_bus_12345678_dev_12345678"). The buffer would be clipped by snprintf() if both %x were at maximum range. Make sure the buffer is long enough to cover such possibility.

Signed-off-by: Marek Vasut marex@denx.de --- Cc: Sean Anderson sean.anderson@seco.com Cc: Simon Glass sjg@chromium.org --- drivers/usb/host/usb-uclass.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/usb-uclass.c b/drivers/usb/host/usb-uclass.c index 27e2fc6fcd3..060f3441df0 100644 --- a/drivers/usb/host/usb-uclass.c +++ b/drivers/usb/host/usb-uclass.c @@ -557,7 +557,7 @@ static int usb_find_and_bind_driver(struct udevice *parent, struct usb_driver_entry *start, *entry; int n_ents; int ret; - char name[30], *str; + char name[34], *str; ofnode node = usb_get_ofnode(parent, port);

*devp = NULL;