fix an off by one array bounds issue, and also fix a potentially non

nul-terminated string.
This commit is contained in:
mrg 2011-07-07 08:48:34 +00:00
parent 0514da4400
commit 602d34897a

View File

@ -1,4 +1,4 @@
/* $NetBSD: gumstix_machdep.c,v 1.37 2011/07/01 20:39:34 dyoung Exp $ */ /* $NetBSD: gumstix_machdep.c,v 1.38 2011/07/07 08:48:34 mrg Exp $ */
/* /*
* Copyright (C) 2005, 2006, 2007 WIDE Project and SOUM Corporation. * Copyright (C) 2005, 2006, 2007 WIDE Project and SOUM Corporation.
* All rights reserved. * All rights reserved.
@ -222,6 +222,7 @@ u_int cpu_reset_address = 0;
BootConfig bootconfig; /* Boot config storage */ BootConfig bootconfig; /* Boot config storage */
static char bootargs[MAX_BOOT_STRING]; static char bootargs[MAX_BOOT_STRING];
const size_t bootargs_len = sizeof(bootargs) - 1; /* without nul */
char *boot_args = NULL; char *boot_args = NULL;
uint32_t system_serial_high; uint32_t system_serial_high;
@ -1092,13 +1093,14 @@ process_kernel_args(int argc, char *argv[])
consinit(); consinit();
} }
#endif #endif
if (j == MAX_BOOT_STRING) { if (j == bootargs_len) {
*(bootargs + j) = '\0'; *(bootargs + j) = '\0';
continue; continue;
} }
if (j != 0) if (j != 0)
*(bootargs + j++) = ' '; *(bootargs + j++) = ' ';
strncpy(bootargs + j, argv[i], MAX_BOOT_STRING - j); strncpy(bootargs + j, argv[i], bootargs_len - j);
bootargs[bootargs_len] = '\0';
j += strlen(argv[i]); j += strlen(argv[i]);
} }
boot_args = bootargs; boot_args = bootargs;