cmd/nvedit.c: Update input handling to cover overflow cases

When we have multiple messages provided, we need to be sure that we do
not exceed the length of our 'message' buffer.  In the for loop, make
sure that pos is not larger than message.  Only copy in at most however
much of the message buffer remains.  Finally, if we have not reached the
end of the message buffer, put in a space and NULL, and if we have,
ensure the buffer is now NULL termined.

Reported-by: Coverity (CID: 165116)
Signed-off-by: Tom Rini <trini@konsulko.com>

diff --git a/cmd/nvedit.c b/cmd/nvedit.c
index 228e904e1d51dd2a41d180b1ffe6a7b8f476a3aa..8752ff475aed7b2b03f50cf3a4b693934feb0fe8 100644 (file)
--- a/cmd/nvedit.c
+++ b/cmd/nvedit.c
@@ -393,15 +393,18 @@ int do_env_ask(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
                sprintf(message, "Please enter '%s': ", argv[1]);
        } else {
                /* env_ask envname message1 ... messagen [size] */
-               for (i = 2, pos = 0; i < argc; i++) {
+               for (i = 2, pos = 0; i < argc && pos < sizeof(message); i++) {
                        if (pos)
                                message[pos++] = ' ';
 
-                       strcpy(message + pos, argv[i]);
+                       strncpy(message + pos, argv[i], sizeof(message) - pos);
                        pos += strlen(argv[i]);
                }
-               message[pos++] = ' ';
-               message[pos] = '\0';
+               if (pos < sizeof(message) - 1) {
+                       message[pos++] = ' ';
+                       message[pos] = '\0';
+               } else
+                       message[CONFIG_SYS_CBSIZE - 1] = '\0';
        }
 
        if (size >= CONFIG_SYS_CBSIZE)