diff options
| author | Andrew Scull <ascull@google.com> | 2022-04-03 10:39:09 +0000 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2022-04-29 11:11:36 -0400 |
| commit | 3849ca7b2f8363dee751c6918df0aacf64cde3bd (patch) | |
| tree | 728e63f6e501a84e9337c10727473d277f3a6615 /cmd | |
| parent | 53cb97c093061b81ab3247c432d15be011353470 (diff) | |
acpi: Fix buffer overflow in do_acpi_dump()
When do_acpi_dump() converts the table name to upper case, pass the
actual size of the output buffer so that the null terminator doesn't get
written beyond the end of the buffer.
Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Cc: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Cc: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'cmd')
| -rw-r--r-- | cmd/acpi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/cmd/acpi.c b/cmd/acpi.c index c543f1e3c2..0e473b415d 100644 --- a/cmd/acpi.c +++ b/cmd/acpi.c @@ -178,7 +178,7 @@ static int do_acpi_dump(struct cmd_tbl *cmdtp, int flag, int argc, printf("Table name '%s' must be four characters\n", name); return CMD_RET_FAILURE; } - str_to_upper(name, sig, -1); + str_to_upper(name, sig, ACPI_NAME_LEN); ret = dump_table_name(sig); if (ret) { printf("Table '%.*s' not found\n", ACPI_NAME_LEN, sig); |