stdio: fix stdio_deregister_dev()

When copying the name of a stdio device we must ensure that it is NUL
terminated before passing it to strcmp() to avoid a buffer overrun.

Truncating the name field leads to failure to deregister a stdio device.
When copying we must ensure that the name field sizes match.

Addresses-Coverity-ID: 350462 String not null terminated
Fixes: 5294e97832a6 ("stdio: extend "name" to 32 symbols")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

diff --git a/common/stdio.c b/common/stdio.c
index 010bf576af0a63c9d82908cfe72f52c70e32d1cc..e3354f092dc9f0dc07247e8a87bfa54f426b4e26 100644 (file)
--- a/common/stdio.c
+++ b/common/stdio.c
@@ -259,7 +259,7 @@ int stdio_register(struct stdio_dev *dev)
 int stdio_deregister_dev(struct stdio_dev *dev, int force)
 {
        struct list_head *pos;
-       char temp_names[3][16];
+       char temp_names[3][STDIO_NAME_LEN];
        int i;
 
        /* get stdio devices (ListRemoveItem changes the dev list) */
@@ -272,8 +272,8 @@ int stdio_deregister_dev(struct stdio_dev *dev, int force)
                        /* Device is assigned -> report error */
                        return -EBUSY;
                }
-               memcpy(&temp_names[i][0], stdio_devices[i]->name,
-                      sizeof(temp_names[i]));
+               strlcpy(&temp_names[i][0], stdio_devices[i]->name,
+                       sizeof(temp_names[i]));
        }
 
        list_del(&dev->list);

diff --git a/include/stdio_dev.h b/include/stdio_dev.h
index 7f1810205242ccb3b3a90d64da4542204f3ed045..4e3c4708f807a61e3c251a4c76bab5870272502f 100644 (file)
--- a/include/stdio_dev.h
+++ b/include/stdio_dev.h
@@ -17,6 +17,7 @@
 #define DEV_FLAGS_INPUT         0x00000001     /* Device can be used as input  console */
 #define DEV_FLAGS_OUTPUT 0x00000002    /* Device can be used as output console */
 #define DEV_FLAGS_DM     0x00000004    /* Device priv is a struct udevice * */
+#define STDIO_NAME_LEN 32
 
 int stdio_file_to_flags(const int file);
 
@@ -24,7 +25,7 @@ int stdio_file_to_flags(const int file);
 struct stdio_dev {
        int     flags;                  /* Device flags: input/output/system    */
        int     ext;                    /* Supported extensions                 */
-       char    name[32];               /* Device name                          */
+       char    name[STDIO_NAME_LEN];   /* Device name                          */
 
 /* GENERAL functions */