diff options
| author | Vincent Palatin <vpalatin@chromium.org> | 2012-01-13 15:05:34 -0800 |
|---|---|---|
| committer | Gerrit <chrome-bot@google.com> | 2012-01-13 16:00:43 -0800 |
| commit | c98691ab0e592a4806607192d12a45a9af69d5a0 (patch) | |
| tree | 9f0eff67e75b66e12be1733774af171801a90542 | |
| parent | 45a25a37f94d0d3816c97319ed67f320247e26b6 (diff) | |
stdio: fix stack memory corruption
When copying the device name, the temporary target variable was twice
smaller than the copy size.
Create a define to ensure this won't break again.
Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
BUG=chrome-os-partner:7188 chrome-os-partner:7430 chrome-os-partner:7432
chrome-os-partner:7559
TEST=On lumpy with usb keyboard configured, run in recovery mode, insert
a bad key, press tab, remove the key, press tab. The recovery info are
displayed properly.
Change-Id: Ia9e765555d2f4efba81b8c389be2778cf2b92db0
Reviewed-on: https://gerrit.chromium.org/gerrit/14185
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
| -rw-r--r-- | common/stdio.c | 2 | ||||
| -rw-r--r-- | include/stdio_dev.h | 4 |
2 files changed, 4 insertions, 2 deletions
diff --git a/common/stdio.c b/common/stdio.c index f64909d9e1c..8b31a7d1f8c 100644 --- a/common/stdio.c +++ b/common/stdio.c @@ -160,7 +160,7 @@ int stdio_deregister(const char *devname) int l; struct list_head *pos; struct stdio_dev *dev; - char temp_names[3][8]; + char temp_names[MAX_FILES][STDIO_NAME_SIZE]; dev = stdio_get_by_name(devname); diff --git a/include/stdio_dev.h b/include/stdio_dev.h index 932d093345e..6ed1f12b873 100644 --- a/include/stdio_dev.h +++ b/include/stdio_dev.h @@ -35,11 +35,13 @@ #define DEV_FLAGS_SYSTEM 0x80000000 /* Device is a system device */ #define DEV_EXT_VIDEO 0x00000001 /* Video extensions supported */ +#define STDIO_NAME_SIZE 16 + /* Device information */ struct stdio_dev { int flags; /* Device flags: input/output/system */ int ext; /* Supported extensions */ - char name[16]; /* Device name */ + char name[STDIO_NAME_SIZE]; /* Device name */ /* GENERAL functions */ |