From: Heinrich Schuchardt Date: Fri, 5 Jul 2019 19:27:13 +0000 (+0200) Subject: disk: efi: buffer overflow in part_get_info_efi() X-Git-Tag: v2019.10-rc1~39^2~16 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=5375ee508fead38c733a56b394db7bae86435390;p=platform%2Fkernel%2Fu-boot.git disk: efi: buffer overflow in part_get_info_efi() In part_get_info_efi() we use the output of print_efiname() to set info->name[]. The size of info->name is PART_NAME_LEN = 32 but print_efiname() returns a string with a maximum length of PARTNAME_SZ + 1 = 37. Use snprintf() instead of sprintf() to avoid buffer overflow. Signed-off-by: Heinrich Schuchardt --- diff --git a/disk/part_efi.c b/disk/part_efi.c index c0fa753..3e02669 100644 --- a/disk/part_efi.c +++ b/disk/part_efi.c @@ -313,8 +313,8 @@ int part_get_info_efi(struct blk_desc *dev_desc, int part, - info->start; info->blksz = dev_desc->blksz; - sprintf((char *)info->name, "%s", - print_efiname(&gpt_pte[part - 1])); + snprintf((char *)info->name, sizeof(info->name), "%s", + print_efiname(&gpt_pte[part - 1])); strcpy((char *)info->type, "U-Boot"); info->bootable = is_bootable(&gpt_pte[part - 1]); #if CONFIG_IS_ENABLED(PARTITION_UUIDS)