dfu: do stringop with termination character 76/222176/1
authorSeung-Woo Kim <sw0312.kim@samsung.com>
Fri, 10 Jan 2020 06:10:49 +0000 (15:10 +0900)
committerSeung-Woo Kim <sw0312.kim@samsung.com>
Fri, 10 Jan 2020 06:10:51 +0000 (15:10 +0900)
Doing string operation with strlen() result, there is possibilty
of omission of termination character. Do stringop with termination
character with strlen() + 1. The destination buffer is allocated
sum of all strlen() and 1, there is no overflow.

Change-Id: I35627dbbb0ac72bc58398ccfffa43802729c5b85
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
src/dfu.c

index ea548f5..0a1b297 100644 (file)
--- a/src/dfu.c
+++ b/src/dfu.c
@@ -236,8 +236,8 @@ static int dfu_start_entity(struct tfm_context *ctx, int idx, unsigned long size
                }
 
                strncpy(file, DFU_MOUNT_PATH, path_prefix + 1);
-               strncat(file, info[DFU_INFO_PATH], path_suffix);
-               strncat(file, info[DFU_INFO_NAME], path_name);
+               strncat(file, info[DFU_INFO_PATH], path_suffix + 1);
+               strncat(file, info[DFU_INFO_NAME], path_name + 1);
                break;
        }
        default: