cmd: pstore: bound path formatting with snprintf to avoid stack overflow

pstore_save() writes four different filenames into a fixed 256-byte
stack buffer 'path' using sprintf() with "%s" fed from argv[3] (the
user-supplied mount directory). The U-Boot command line buffer
(CONFIG_SYS_CBSIZE) is typically 1024 or 2048 bytes, so a directory
path in argv[3] can easily exceed 240 characters and overflow 'path',
corrupting the surrounding stack frame including the return address.

Replace the four sprintf(path, ...) call sites with snprintf() using
sizeof(path) as the bound. The neighbouring sprintf() calls into the
'addr' and 'length' buffers are left as-is; they write fixed-width
numeric conversions whose maximum length is bounded by the size of
ulong/u32 in hex and cannot overflow those buffers.

Signed-off-by: Naveen Kumar Chaudhary <[email protected]>

0 files changed, 0 insertions, 0 deletions