ram: stm32mp1: bound the invalid-argument message in stm32mp1_ddr_subcmd()

stm32mp1_ddr_subcmd() formats a rejected argument into a 50-byte stack
buffer with an unbounded sprintf():

	char string[50] = "";
	...
	sprintf(string, "invalid argument %s", argv[1]);

argv[1] comes from cli_simple_parse_line() over a console line held in
buffer[CONFIG_SYS_CBSIZE], which is commonly 256 bytes or more. The
fixed prefix takes 17 bytes, leaving 32 for the argument and its NUL, so
any invalid argument longer than 32 characters writes past the end of
string and corrupts the stack of the DDR interactive console.

Use snprintf() with sizeof(string). The sibling call a few lines below
formats only integers and cannot overflow, so it is left alone.

Fixes: 0d447524425e ("stm32mp1: ram: add tests in DDR interactive mode")
Signed-off-by: Ngo Luong Thanh Tra <[email protected]>
Cc: Patrick Delaunay <[email protected]>
Cc: Patrice Chotard <[email protected]>
Cc: Tom Rini <[email protected]>
Reviewed-by: Patrice Chotard <[email protected]>

1 files changed, 2 insertions, 2 deletions

diff --git a/drivers/ram/stm32mp1/stm32mp1_interactive.c b/drivers/ram/stm32mp1/stm32mp1_interactive.c
index 6340afbb870..3154fde6bfb 100644
--- a/drivers/ram/stm32mp1/stm32mp1_interactive.c
+++ b/drivers/ram/stm32mp1/stm32mp1_interactive.c
@@ -334,8 +334,8 @@ static void stm32mp1_ddr_subcmd(struct ddr_info *priv,
 
 	if ((strict_strtoul(argv[1], 0, &value) <  0) ||
 	    value >= array_nb) {
-		sprintf(string, "invalid argument %s",
-			argv[1]);
+		snprintf(string, sizeof(string), "invalid argument %s",
+			 argv[1]);
 		result = TEST_FAILED;
 		goto end;
 	}