getenv_f(): fix handling of too short buffers
PATCH 1/1 getenv_f(): fix handling of too short buffers
Fix error handling in getenv_f() when the user provided buffer is too short to hold the variable name; make sure to truncate and NUL-terminate without overwriting the buffer limits.
Signed-off-by Wolfgang Denk <[email protected]>
--- common/cmd_nvedit.c | 18 ++++++++++++------ 1 files changed, 12 insertions(+), 6 deletions(-)
common/cmd_nvedit.c +12 -6
@@ -557,13 +557,19 @@ int getenv_f(char *name, char *buf, unsigned len) }if ((val=envmatch ((uchar *)name, i)) <0 )continue ; +/* found; copy out */ - n =0 ; -while ((len > n++) && (*buf++ =env_get_char (val++)) !='\0' ) - ; -if (len == n) - *buf ='\0' ; -return (n); +for (n=0 ; n<len; ++n, ++buf) { +if ((*buf =env_get_char (val++)) =='\0' ) +return n; + } + +if (n) + *--buf ='\0' ; + +printf ("env_buf too small [%d]\n" , len); + +return n; }return (-1 ); }
Signature · 1 line
1.7.1.1
Wolfgang Denk
AppliedPATCH 1/1 getenv_f(): fix handling of too short buffers
Quoted 8 lines · In message <[email protected]> you wrote:
Fix error handling in
getenv_f()when the user provided buffer is too short to hold the variable name; make sure to truncate and NUL-terminate without overwriting the buffer limits.Signed-off-by Wolfgang Denk <[email protected]>--- common/cmd_nvedit.c | 18 ++++++++++++------ 1 files changed, 12 insertions(+), 6 deletions(-)
Applied.
Best regards,
Wolfgang Denk
Signature · 5 lines
DENX Software Engineering GmbH, MD: Wolfgang Denk & Detlev Zundel HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de You've no idea of what a poor opinion I have of myself, and how little I deserve it. - W. S. Gilbert