leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usb: gadget: fastboot: terminate commands with NULL

Browse Source 
Without NULL termination, various commands will read past the
end of input. In particular, this was noticed with error()
calls in cb_getvar and simple_strtoul() in cb_download.

Since the download callback happens elsewhere, the 4k buffer
should always be sufficient to handle command arguments.

Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
This commit is contained in:
Eric Nelson 2014-10-01 14:30:56 -07:00 committed by Marek Vasut
parent 16b61d13ba
commit e2140588dd
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/usb/gadget/f_fastboot.c
View File

@ -546,7 +546,14 @@ static void rx_handler_command(struct usb_ep *ep, struct usb_request *req)
error("unknown command: %s\n", cmdbuf);
fastboot_tx_write_str("FAILunknown command");
} else {
func_cb(ep, req);
if (req->actual < req->length) {
u8 *buf = (u8 *)req->buf;
buf[req->actual] = 0;
func_cb(ep, req);
} else {
error("buffer overflow\n");
fastboot_tx_write_str("FAILbuffer overflow");
}
}
if (req->status == 0) {