diff options
| author | Ngo Luong Thanh Tra <[email protected]> | 2026-03-28 13:01:31 +0700 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2026-04-13 17:42:34 -0600 |
| commit | e228b6a50418e261ee09fa326464935acdabe610 (patch) | |
| tree | 1c42f9b538e323944c22a9f7153bcd2ca600fc39 | |
| parent | f7bef8f81f4f1b97b071b14a8c1f61df6285fc63 (diff) | |
board: samsung: fix set_board_info() board_name buffer overflow
Replace unbounded sprintf() with snprintf() using sizeof(info) as
the bound when constructing the board_name string from bdname and
bdtype. The previous call had no size limit and could overflow the
64-byte stack buffer if the concatenated string exceeded 63 bytes.
Fixes: c9c36bf56e4c ("samsung: misc: use board specific functions to set env board info")
Signed-off-by: Ngo Luong Thanh Tra <[email protected]>
To: [email protected]
| -rw-r--r-- | board/samsung/common/misc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/board/samsung/common/misc.c b/board/samsung/common/misc.c index 85e564f27ee..a6ba41d2805 100644 --- a/board/samsung/common/misc.c +++ b/board/samsung/common/misc.c @@ -101,7 +101,7 @@ void set_board_info(void) if (!bdtype) bdtype = ""; - sprintf(info, "%s%s", bdname, bdtype); + snprintf(info, sizeof(info), "%s%s", bdname, bdtype); env_set("board_name", info); #endif snprintf(info, ARRAY_SIZE(info), "%s%x-%s%s.dtb", |