On Mon, Apr 26, 2021 at 12:08 AM Yuichiro Goto goto@k-tech.co.jp wrote:

Use of strcat() against an uninitialized buffer would lead to buffer overflow. This patch fixes it.

Fixes: 694cd5618c ("IOMUX: Introduce iomux_replace_device()") Signed-off-by: Yuichiro Goto goto@k-tech.co.jp Cc: Peter Robinson pbrobinson@gmail.com Cc: Andy Shevchenko andriy.shevchenko@linux.intel.com Cc: Nicolas Saenz Julienne nsaenzjulienne@suse.de

Tested-by: Peter Robinson pbrobinson@gmail.com On a RPi2/RPi3 and Cubieboard

---

Changes for v3:

• Add a Fixes tag in commit message
• Refactor the patch per suggestion from Andy Shevchenko

Changes for v2:

• Add "IOMUX" in title

common/iomux.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/common/iomux.c b/common/iomux.c index b9088aa3b5..c428f7110a 100644 --- a/common/iomux.c +++ b/common/iomux.c @@ -158,8 +158,12 @@ int iomux_replace_device(const int console, const char *old, const char *new) return -ENOMEM; }

•           strcat(tmp, ",");
  

•           strcat(tmp, name);
  

•           if (arg) {
  

•                   strcat(tmp, ",");
  

•                   strcat(tmp, name);
  

•           }
  

•           else
  

•                   strcpy(tmp, name);
  
            arg = tmp;
            size = strlen(tmp) + 1;
  

-- 2.17.1