Commit af0b4d5a authored by Johan Hovold's avatar Johan Hovold

greybus: firmware: fix potential stack corruption

Use snprintf when generating the firmware name to avoid stack corruption
if the fixed-size buffer overflows.

Note that the current buffer size appears to expect 16-bit ids while
the they are actually 32-bit, something which could trigger the
corruption.
Signed-off-by: default avatarJohan Hovold <johan@hovoldconsulting.com>
Reviewed-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
parent 977e209a
......@@ -38,9 +38,10 @@ static int download_firmware(struct gb_firmware *firmware, u8 stage)
*
* XXX Name it properly..
*/
sprintf(firmware_name, "ara:%04x:%04x:%04x:%04x:%04x.fw", intf->unipro_mfg_id,
intf->unipro_prod_id, intf->ara_vend_id, intf->ara_prod_id,
stage);
snprintf(firmware_name, sizeof(firmware_name),
"ara:%04x:%04x:%04x:%04x:%04x.fw",
intf->unipro_mfg_id, intf->unipro_prod_id,
intf->ara_vend_id, intf->ara_prod_id, stage);
return request_firmware(&firmware->fw, firmware_name, &connection->dev);
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment