From 3849ca7b2f8363dee751c6918df0aacf64cde3bd Mon Sep 17 00:00:00 2001 From: Andrew Scull Date: Sun, 3 Apr 2022 10:39:09 +0000 Subject: [PATCH] acpi: Fix buffer overflow in do_acpi_dump() When do_acpi_dump() converts the table name to upper case, pass the actual size of the output buffer so that the null terminator doesn't get written beyond the end of the buffer. Signed-off-by: Andrew Scull Cc: Simon Glass Cc: Wolfgang Wallner Cc: Bin Meng Reviewed-by: Simon Glass --- cmd/acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/acpi.c b/cmd/acpi.c index c543f1e..0e473b4 100644 --- a/cmd/acpi.c +++ b/cmd/acpi.c @@ -178,7 +178,7 @@ static int do_acpi_dump(struct cmd_tbl *cmdtp, int flag, int argc, printf("Table name '%s' must be four characters\n", name); return CMD_RET_FAILURE; } - str_to_upper(name, sig, -1); + str_to_upper(name, sig, ACPI_NAME_LEN); ret = dump_table_name(sig); if (ret) { printf("Table '%.*s' not found\n", ACPI_NAME_LEN, sig); -- 2.7.4