diff options
| author | Francois Berder <[email protected]> | 2026-03-05 17:40:05 +0100 |
|---|---|---|
| committer | Fabio Estevam <[email protected]> | 2026-03-16 18:44:33 -0300 |
| commit | 262258dc75f2e07c2ab7a830656eae94ab4a8be9 (patch) | |
| tree | 0faeb005e09bec10f025462269d0a5b7a89588c7 | |
| parent | 7d39e293509fd1b41a597e7db99804a1c17c5207 (diff) | |
liebherr: btt: Fix buffer overflow in board_fit_config_name_match
The maximum length of the board name is not 11 characters
but 14: 11 bytes for the prefix + 3 bytes for the u8 + 1 NULL byte.
Hence, this commit increases the size of the name buffer variable
to 15. Also, this commit fixes the format specifier for the rev_id
variable.
Signed-off-by: Francois Berder <[email protected]>
| -rw-r--r-- | board/liebherr/btt/btt.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/board/liebherr/btt/btt.c b/board/liebherr/btt/btt.c index c4b6c37e495..dc683bd082a 100644 --- a/board/liebherr/btt/btt.c +++ b/board/liebherr/btt/btt.c @@ -393,9 +393,9 @@ int board_fdt_blob_setup(void **fdtp) int board_fit_config_name_match(const char *name) { u8 rev_id = get_som_rev(); - char board[12]; + char board[15]; - sprintf(board, "imx28-btt3-%d", rev_id); + sprintf(board, "imx28-btt3-%u", rev_id); if (!strncmp(name, board, sizeof(board))) return 0; |