diff options
| author | Wolfgang Denk <wd@denx.de> | 2010-07-24 22:16:20 +0200 |
|---|---|---|
| committer | Wolfgang Denk <wd@denx.de> | 2010-08-09 00:53:57 +0200 |
| commit | 9ed4a9582ff61225d46241a1c99795549722503c (patch) | |
| tree | 26d69509babcff8af8f7316fbb8cbe4c04e84606 | |
| parent | 739b8080af30d6de73b13725abe27275dd3b27f6 (diff) | |
| download | u-boot-midas-9ed4a9582ff61225d46241a1c99795549722503c.tar.gz u-boot-midas-9ed4a9582ff61225d46241a1c99795549722503c.tar.bz2 u-boot-midas-9ed4a9582ff61225d46241a1c99795549722503c.zip | |
getenv_f(): fix handling of too short buffers
Fix error handling in getenv_f() when the user provided buffer is too
short to hold the variable name; make sure to truncate and
NUL-terminate without overwriting the buffer limits.
Signed-off-by: Wolfgang Denk <wd@denx.de>
| -rw-r--r-- | common/cmd_nvedit.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/common/cmd_nvedit.c b/common/cmd_nvedit.c index 16d5ff74d9..fd5320d170 100644 --- a/common/cmd_nvedit.c +++ b/common/cmd_nvedit.c @@ -557,13 +557,19 @@ int getenv_f(char *name, char *buf, unsigned len) } if ((val=envmatch((uchar *)name, i)) < 0) continue; + /* found; copy out */ - n = 0; - while ((len > n++) && (*buf++ = env_get_char(val++)) != '\0') - ; - if (len == n) - *buf = '\0'; - return (n); + for (n=0; n<len; ++n, ++buf) { + if ((*buf = env_get_char(val++)) == '\0') + return n; + } + + if (n) + *--buf = '\0'; + + printf("env_buf too small [%d]\n", len); + + return n; } return (-1); } |