Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-02 09:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

cmd: gpt: Fix off by 1 errors

Browse Source 
The buffer for a name to be copied into must also contain the
terminating 0 byte but strlen returns the length of the string without
counting that 0 byte. Adjust the length checks to take this into
account.

This issue found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
This commit is contained in:
Andrew Goodbody
2025-07-16 11:55:47 +01:00
committed by Tom Rini
parent d29c1092eb
commit 25d3e0509c
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
cmd/gpt.c
View File

@@ -911,8 +911,9 @@ static int do_rename_gpt_parts(struct blk_desc *dev_desc, char *subcomm,
goto out;
if (!strcmp(subcomm, "swap")) {
if ((strlen(name1) > PART_NAME_LEN) || (strlen(name2) > PART_NAME_LEN)) {
printf("Names longer than %d characters are truncated.\n", PART_NAME_LEN);
if ((strlen(name1) >= PART_NAME_LEN) || (strlen(name2) >= PART_NAME_LEN)) {
printf("Names longer than %d characters are truncated.\n",
PART_NAME_LEN - 1);
ret = -EINVAL;
goto out;
}
@@ -967,8 +968,9 @@ static int do_rename_gpt_parts(struct blk_desc *dev_desc, char *subcomm,
*first = *second;
*second = tmp_part;
} else { /* rename */
if (strlen(name2) > PART_NAME_LEN) {
printf("Names longer than %d characters are truncated.\n", PART_NAME_LEN);
if (strlen(name2) >= PART_NAME_LEN) {
printf("Names longer than %d characters are truncated.\n",
PART_NAME_LEN - 1);
ret = -EINVAL;
goto out;
}