diff options
| author | Eric Nelson | 2014-10-01 14:30:56 -0700 |
|---|---|---|
| committer | Marek Vasut | 2014-10-06 21:07:44 +0200 |
| commit | e2140588dd2f3e619f21d9575281b7c7ea771c09 (patch) | |
| tree | 8462728474bc08d9500427916b6c98d4101614be | |
| parent | 16b61d13bab361853564da401b15fc34ae1dfea7 (diff) | |
usb: gadget: fastboot: terminate commands with NULL
Without NULL termination, various commands will read past the
end of input. In particular, this was noticed with error()
calls in cb_getvar and simple_strtoul() in cb_download.
Since the download callback happens elsewhere, the 4k buffer
should always be sufficient to handle command arguments.
Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com>
| -rw-r--r-- | drivers/usb/gadget/f_fastboot.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c index 392379dce41..71b62e5005a 100644 --- a/drivers/usb/gadget/f_fastboot.c +++ b/drivers/usb/gadget/f_fastboot.c @@ -546,7 +546,14 @@ static void rx_handler_command(struct usb_ep *ep, struct usb_request *req) error("unknown command: %s\n", cmdbuf); fastboot_tx_write_str("FAILunknown command"); } else { - func_cb(ep, req); + if (req->actual < req->length) { + u8 *buf = (u8 *)req->buf; + buf[req->actual] = 0; + func_cb(ep, req); + } else { + error("buffer overflow\n"); + fastboot_tx_write_str("FAILbuffer overflow"); + } } if (req->status == 0) { |