image: Protect against overflow in unknown_msg()

Coverity complains that this can overflow. If we later increase the size of one of the strings in the table, it could happen.

Adjust the code to protect against this.

Signed-off-by Simon Glass <[email protected]>

Reported-by Coverity (CID: 150964)

---

Changes in v2:
- Drop unwanted #include

 common/image.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

common/image.c +0 -0

index 0e86c13..4255267 100644

common/image.c +0 -0

 	return msg;
 }

Quoted 20 lines · On Thu, 27 Oct 2016 18:38:40 -0600 Simon Glass <[email protected]> wrote:

Coverity complains that this can overflow. If we later increase the size of one of the strings in the table, it could happen.

Adjust the code to protect against this.

Signed-off-by Simon Glass <[email protected]>

Reported-by Coverity (CID: 150964)

---

Changes in v2:
- Drop unwanted #include

 common/image.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

common/image.c +0 -0

index 0e86c13..4255267 100644

common/image.c static const char *unknown_msg(enum ih_category category) · line 593

Quoted 5 lines

common/image.c +1 -1

@@ -590,7 +590,7 @@ static const char *unknown_msg(enum ih_category category)
      static char msg[30];
 
      strcpy(msg, "Unknown ");
-     strcat(msg, table_info[category].desc);
+     strncat(msg, table_info[category].desc, sizeof(msg) - 1);

"man strncat" on my system says:

char *strncat(char *dest, const char *src, size_t n);

...

If src contains n or more bytes, strncat() writes n+1 bytes to dest (n from src plus the terminating null byte). Therefore, the size of dest must be at least strlen(dest)+n+1.

Quoted 3 lines

common/image.c +0 -0

      return msg;
 }