diff options
| author | Daniel Golle <[email protected]> | 2026-08-15 16:08:45 +0100 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2026-08-24 09:19:03 -0600 |
| commit | fb79a4fcb09b49c6d6ef0a9a030e1abef32358e9 (patch) | |
| tree | 5556a2c83cb0be4cdffdb0dd59f6d1ff3e02f445 | |
| parent | 6073c36b2c8d39afe3ecc789b281667a3ddebc70 (diff) | |
disk: ubi: use a format string when copying the volume name
part_get_info_ubi() passes the UBI volume name straight to snprintf() as
its format argument:
snprintf(info->name, PART_NAME_LEN, vol->name);
A volume name that contains a '%' is then interpreted as a printf
conversion specifier, yielding a wrong partition name or reading
unintended variadic arguments; a '%n' would be undefined behaviour.
Volume names are user-defined and boot methods select images by volume
name, so copy the name through a "%s" format instead.
Fixes: aa5b67ce2262 ("disk: support UBI partitions")
Signed-off-by: Daniel Golle <[email protected]>
Reviewed-by: Heiko Schocher <[email protected]>
| -rw-r--r-- | drivers/mtd/ubi/part.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/ubi/part.c b/drivers/mtd/ubi/part.c index 6c017eb7299..aff0b109b70 100644 --- a/drivers/mtd/ubi/part.c +++ b/drivers/mtd/ubi/part.c @@ -49,7 +49,7 @@ static int __maybe_unused part_get_info_ubi(struct blk_desc *dev_desc, int part_ if (!vol) return -ENOENT; - snprintf(info->name, PART_NAME_LEN, vol->name); + snprintf(info->name, PART_NAME_LEN, "%s", vol->name); info->start = 0; info->size = (unsigned long)vol->used_bytes / dev_desc->blksz; |