summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ubi-utils/src/libmtd.c21
-rw-r--r--ubi-utils/src/libubi.c17
-rw-r--r--ubi-utils/src/libubigen.c6
3 files changed, 30 insertions, 14 deletions
diff --git a/ubi-utils/src/libmtd.c b/ubi-utils/src/libmtd.c
index 046beea..b050bea 100644
--- a/ubi-utils/src/libmtd.c
+++ b/ubi-utils/src/libmtd.c
@@ -89,6 +89,14 @@ static int read_data(const char *file, void *buf, int buf_len)
goto out_error;
}
+ if (rd == buf_len) {
+ errmsg("contents of \"%s\" is too long", file);
+ errno = EINVAL;
+ goto out_error;
+ }
+
+ ((char *)buf)[rd] = '\0';
+
/* Make sure all data is read */
tmp1 = read(fd, &tmp, 1);
if (tmp1 == 1) {
@@ -199,16 +207,17 @@ static int read_hex_ll(const char *file, long long *value)
if (fd == -1)
return -1;
- rd = read(fd, buf, 50);
+ rd = read(fd, buf, sizeof(buf));
if (rd == -1) {
sys_errmsg("cannot read \"%s\"", file);
goto out_error;
}
- if (rd == 50) {
+ if (rd == sizeof(buf)) {
errmsg("contents of \"%s\" is too long", file);
errno = EINVAL;
goto out_error;
}
+ buf[rd] = '\0';
if (sscanf(buf, "%llx\n", value) != 1) {
errmsg("cannot read integer from \"%s\"\n", file);
@@ -571,7 +580,7 @@ int mtd_get_info(libmtd_t desc, struct mtd_info *info)
struct dirent *dirent;
struct libmtd *lib = (struct libmtd *)desc;
- memset(info, '\0', sizeof(struct mtd_info));
+ memset(info, 0, sizeof(struct mtd_info));
if (!lib->sysfs_supported)
return legacy_mtd_get_info(info);
@@ -643,7 +652,7 @@ int mtd_get_dev_info1(libmtd_t desc, int dev_num, struct mtd_dev_info *mtd)
struct stat st;
struct libmtd *lib = (struct libmtd *)desc;
- memset(mtd, '\0', sizeof(struct mtd_dev_info));
+ memset(mtd, 0, sizeof(struct mtd_dev_info));
mtd->dev_num = dev_num;
if (!lib->sysfs_supported)
@@ -663,13 +672,13 @@ int mtd_get_dev_info1(libmtd_t desc, int dev_num, struct mtd_dev_info *mtd)
return -1;
ret = dev_read_data(lib->mtd_name, dev_num, &mtd->name,
- MTD_NAME_MAX);
+ MTD_NAME_MAX + 1);
if (ret < 0)
return -1;
((char *)mtd->name)[ret - 1] = '\0';
ret = dev_read_data(lib->mtd_type, dev_num, &mtd->type_str,
- MTD_TYPE_MAX);
+ MTD_TYPE_MAX + 1);
if (ret < 0)
return -1;
((char *)mtd->type_str)[ret - 1] = '\0';
diff --git a/ubi-utils/src/libubi.c b/ubi-utils/src/libubi.c
index 6f9228e..a4313ab 100644
--- a/ubi-utils/src/libubi.c
+++ b/ubi-utils/src/libubi.c
@@ -166,6 +166,13 @@ static int read_data(const char *file, void *buf, int buf_len)
sys_errmsg("cannot read \"%s\"", file);
goto out_error;
}
+
+ if (rd == buf_len) {
+ errmsg("contents of \"%s\" is too long", file);
+ errno = EINVAL;
+ goto out_error;
+ }
+
((char *)buf)[rd] = '\0';
/* Make sure all data is read */
@@ -676,7 +683,7 @@ int ubi_attach_mtd(libubi_t desc, const char *node,
int fd, ret;
struct ubi_attach_req r;
- memset(&r, sizeof(struct ubi_attach_req), '\0');
+ memset(&r, 0, sizeof(struct ubi_attach_req));
desc = desc;
r.ubi_num = req->dev_num;
@@ -806,7 +813,7 @@ int ubi_get_info(libubi_t desc, struct ubi_info *info)
struct dirent *dirent;
struct libubi *lib = (struct libubi *)desc;
- memset(info, '\0', sizeof(struct ubi_info));
+ memset(info, 0, sizeof(struct ubi_info));
if (read_major(lib->ctrl_dev, &info->ctrl_major, &info->ctrl_minor)) {
/*
@@ -881,7 +888,7 @@ int ubi_mkvol(libubi_t desc, const char *node, struct ubi_mkvol_request *req)
struct ubi_mkvol_req r;
size_t n;
- memset(&r, sizeof(struct ubi_mkvol_req), '\0');
+ memset(&r, 0, sizeof(struct ubi_mkvol_req));
desc = desc;
r.vol_id = req->vol_id;
@@ -1034,7 +1041,7 @@ int ubi_get_dev_info1(libubi_t desc, int dev_num, struct ubi_dev_info *info)
struct dirent *dirent;
struct libubi *lib = (struct libubi *)desc;
- memset(info, '\0', sizeof(struct ubi_dev_info));
+ memset(info, 0, sizeof(struct ubi_dev_info));
info->dev_num = dev_num;
if (!dev_present(lib, dev_num))
@@ -1137,7 +1144,7 @@ int ubi_get_vol_info1(libubi_t desc, int dev_num, int vol_id,
struct libubi *lib = (struct libubi *)desc;
char buf[50];
- memset(info, '\0', sizeof(struct ubi_vol_info));
+ memset(info, 0, sizeof(struct ubi_vol_info));
info->dev_num = dev_num;
info->vol_id = vol_id;
diff --git a/ubi-utils/src/libubigen.c b/ubi-utils/src/libubigen.c
index fddc1d8..a34963e 100644
--- a/ubi-utils/src/libubigen.c
+++ b/ubi-utils/src/libubigen.c
@@ -122,7 +122,7 @@ int ubigen_add_volume(const struct ubigen_info *ui,
return errmsg("too large alignment %d, max is %d (LEB size)",
vi->alignment, ui->leb_size);
- memset(vtbl_rec, '\0', sizeof(struct ubi_vtbl_record));
+ memset(vtbl_rec, 0, sizeof(struct ubi_vtbl_record));
tmp = (vi->bytes + ui->leb_size - 1) / ui->leb_size;
vtbl_rec->reserved_pebs = cpu_to_be32(tmp);
vtbl_rec->alignment = cpu_to_be32(vi->alignment);
@@ -151,7 +151,7 @@ void ubigen_init_ec_hdr(const struct ubigen_info *ui,
{
uint32_t crc;
- memset(hdr, '\0', sizeof(struct ubi_ec_hdr));
+ memset(hdr, 0, sizeof(struct ubi_ec_hdr));
hdr->magic = cpu_to_be32(UBI_EC_HDR_MAGIC);
hdr->version = ui->ubi_ver;
@@ -183,7 +183,7 @@ static void init_vid_hdr(const struct ubigen_info *ui,
{
uint32_t crc;
- memset(hdr, '\0', sizeof(struct ubi_vid_hdr));
+ memset(hdr, 0, sizeof(struct ubi_vid_hdr));
hdr->magic = cpu_to_be32(UBI_VID_HDR_MAGIC);
hdr->version = ui->ubi_ver;