summaryrefslogtreecommitdiff
path: root/board
diff options
context:
space:
mode:
authorHeinrich Schuchardt <xypron.glpk@gmx.de>2017-07-30 22:18:18 +0200
committerMichal Simek <michal.simek@xilinx.com>2017-08-02 09:11:52 +0200
commitdf1cd46fb84922735e1c12f54b7202b0268dcddd (patch)
tree1b5d9af441de42562408e954be4a8735b72aea6b /board
parent74ba69db35954e473a27711de89dae9572913478 (diff)
arm64: zynqmp: avoid out of buffer access
strncat(a, b, c) appends a maximum of c characters plus the 0 byte to a. In board_init we first write 4 characters plus 0 byte to version. So only ZYNQMP_VERSION_SIZE - 5 additional characters fit into version. The problem was indicated by cppcheck. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Diffstat (limited to 'board')
-rw-r--r--board/xilinx/zynqmp/zynqmp.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c
index 07e04868178..aebd3df8a97 100644
--- a/board/xilinx/zynqmp/zynqmp.c
+++ b/board/xilinx/zynqmp/zynqmp.c
@@ -172,10 +172,10 @@ int board_init(void)
if (current_el() != 3) {
static char version[ZYNQMP_VERSION_SIZE];
- strncat(version, "xczu", ZYNQMP_VERSION_SIZE);
+ strncat(version, "xczu", 4);
zynqmppl.name = strncat(version,
zynqmp_get_silicon_idcode_name(),
- ZYNQMP_VERSION_SIZE);
+ ZYNQMP_VERSION_SIZE - 5);
printf("Chip ID:\t%s\n", zynqmppl.name);
fpga_init();
fpga_add(fpga_xilinx, &zynqmppl);