summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWolfgang Denk <wd@denx.de>2010-07-24 22:16:20 +0200
committerWolfgang Denk <wd@denx.de>2010-08-09 00:53:57 +0200
commit9ed4a9582ff61225d46241a1c99795549722503c (patch)
tree26d69509babcff8af8f7316fbb8cbe4c04e84606
parent739b8080af30d6de73b13725abe27275dd3b27f6 (diff)
downloadu-boot-imx-9ed4a9582ff61225d46241a1c99795549722503c.zip
u-boot-imx-9ed4a9582ff61225d46241a1c99795549722503c.tar.gz
u-boot-imx-9ed4a9582ff61225d46241a1c99795549722503c.tar.bz2
getenv_f(): fix handling of too short buffers
Fix error handling in getenv_f() when the user provided buffer is too short to hold the variable name; make sure to truncate and NUL-terminate without overwriting the buffer limits. Signed-off-by: Wolfgang Denk <wd@denx.de>
-rw-r--r--common/cmd_nvedit.c18
1 files changed, 12 insertions, 6 deletions
diff --git a/common/cmd_nvedit.c b/common/cmd_nvedit.c
index 16d5ff7..fd5320d 100644
--- a/common/cmd_nvedit.c
+++ b/common/cmd_nvedit.c
@@ -557,13 +557,19 @@ int getenv_f(char *name, char *buf, unsigned len)
}
if ((val=envmatch((uchar *)name, i)) < 0)
continue;
+
/* found; copy out */
- n = 0;
- while ((len > n++) && (*buf++ = env_get_char(val++)) != '\0')
- ;
- if (len == n)
- *buf = '\0';
- return (n);
+ for (n=0; n<len; ++n, ++buf) {
+ if ((*buf = env_get_char(val++)) == '\0')
+ return n;
+ }
+
+ if (n)
+ *--buf = '\0';
+
+ printf("env_buf too small [%d]\n", len);
+
+ return n;
}
return (-1);
}