From df1cd46fb84922735e1c12f54b7202b0268dcddd Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Sun, 30 Jul 2017 22:18:18 +0200 Subject: [PATCH] arm64: zynqmp: avoid out of buffer access strncat(a, b, c) appends a maximum of c characters plus the 0 byte to a. In board_init we first write 4 characters plus 0 byte to version. So only ZYNQMP_VERSION_SIZE - 5 additional characters fit into version. The problem was indicated by cppcheck. Signed-off-by: Heinrich Schuchardt Signed-off-by: Michal Simek --- board/xilinx/zynqmp/zynqmp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c index 07e0486817..aebd3df8a9 100644 --- a/board/xilinx/zynqmp/zynqmp.c +++ b/board/xilinx/zynqmp/zynqmp.c @@ -172,10 +172,10 @@ int board_init(void) if (current_el() != 3) { static char version[ZYNQMP_VERSION_SIZE]; - strncat(version, "xczu", ZYNQMP_VERSION_SIZE); + strncat(version, "xczu", 4); zynqmppl.name = strncat(version, zynqmp_get_silicon_idcode_name(), - ZYNQMP_VERSION_SIZE); + ZYNQMP_VERSION_SIZE - 5); printf("Chip ID:\t%s\n", zynqmppl.name); fpga_init(); fpga_add(fpga_xilinx, &zynqmppl); -- 2.39.5