summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Nelson <eric.nelson@boundarydevices.com>2014-10-01 14:30:56 -0700
committerMarek Vasut <marex@denx.de>2014-10-06 21:07:44 +0200
commite2140588dd2f3e619f21d9575281b7c7ea771c09 (patch)
tree8462728474bc08d9500427916b6c98d4101614be
parent16b61d13bab361853564da401b15fc34ae1dfea7 (diff)
downloadu-boot-imx-e2140588dd2f3e619f21d9575281b7c7ea771c09.zip
u-boot-imx-e2140588dd2f3e619f21d9575281b7c7ea771c09.tar.gz
u-boot-imx-e2140588dd2f3e619f21d9575281b7c7ea771c09.tar.bz2
usb: gadget: fastboot: terminate commands with NULL
Without NULL termination, various commands will read past the end of input. In particular, this was noticed with error() calls in cb_getvar and simple_strtoul() in cb_download. Since the download callback happens elsewhere, the 4k buffer should always be sufficient to handle command arguments. Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
-rw-r--r--drivers/usb/gadget/f_fastboot.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c
index 392379d..71b62e5 100644
--- a/drivers/usb/gadget/f_fastboot.c
+++ b/drivers/usb/gadget/f_fastboot.c
@@ -546,7 +546,14 @@ static void rx_handler_command(struct usb_ep *ep, struct usb_request *req)
error("unknown command: %s\n", cmdbuf);
fastboot_tx_write_str("FAILunknown command");
} else {
- func_cb(ep, req);
+ if (req->actual < req->length) {
+ u8 *buf = (u8 *)req->buf;
+ buf[req->actual] = 0;
+ func_cb(ep, req);
+ } else {
+ error("buffer overflow\n");
+ fastboot_tx_write_str("FAILbuffer overflow");
+ }
}
if (req->status == 0) {