fastboot: Correct fastboot_fail and fastboot_okay strings
authorDileep Katta <dileep.katta@linaro.org>
Fri, 13 Feb 2015 06:33:42 +0000 (14:33 +0800)
committerMarek Vasut <marex@denx.de>
Wed, 25 Feb 2015 16:47:02 +0000 (17:47 +0100)
If the string is copied without NULL termination using strncpy(),
then strncat() on the next line, may concatenate the string after
some stale (or random) data, if the response string was not
zero-initialized.

Signed-off-by: Dileep Katta <dileep.katta@linaro.org>
Reviewed-by: Steve Rae <srae@broadcom.com>
Reviewed-by: Lukasz Majewski <l.majewski@samsung.com>
common/fb_mmc.c

index 513b7ab02c2624d5930022d0906c42fbcdbe51ad..75899e4c285842451b519d3c8edff51014e2f35a 100644 (file)
@@ -23,13 +23,13 @@ static char *response_str;
 
 void fastboot_fail(const char *s)
 {
-       strncpy(response_str, "FAIL", 4);
+       strncpy(response_str, "FAIL\0", 5);
        strncat(response_str, s, RESPONSE_LEN - 4 - 1);
 }
 
 void fastboot_okay(const char *s)
 {
-       strncpy(response_str, "OKAY", 4);
+       strncpy(response_str, "OKAY\0", 5);
        strncat(response_str, s, RESPONSE_LEN - 4 - 1);
 }