提交 df1cd46f 编写于 作者: H Heinrich Schuchardt 提交者: Michal Simek

arm64: zynqmp: avoid out of buffer access

strncat(a, b, c) appends a maximum of c characters plus the 0 byte
to a.

In board_init we first write 4 characters plus 0 byte to version.
So only ZYNQMP_VERSION_SIZE - 5 additional characters fit into
version.

The problem was indicated by cppcheck.
Signed-off-by: NHeinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: NMichal Simek <michal.simek@xilinx.com>
上级 74ba69db
......@@ -172,10 +172,10 @@ int board_init(void)
if (current_el() != 3) {
static char version[ZYNQMP_VERSION_SIZE];
strncat(version, "xczu", ZYNQMP_VERSION_SIZE);
strncat(version, "xczu", 4);
zynqmppl.name = strncat(version,
zynqmp_get_silicon_idcode_name(),
ZYNQMP_VERSION_SIZE);
ZYNQMP_VERSION_SIZE - 5);
printf("Chip ID:\t%s\n", zynqmppl.name);
fpga_init();
fpga_add(fpga_xilinx, &zynqmppl);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册