sprintf will write a trailing \0 at the end of the string so when
writing into a buffer, that buffer must be sized to allow for that
trailing zero. In the DHCP code when the index is a number needing two
digits to express the index would use up the two \0 bytes in the buffer
and the trailing \0 from sprintf would be beyond the end of the
allocation. Fix this by adding a third \0 in the buffer.
This was found by code inspection when looking for an issue reported by
Michal Simek, but I do not have the hardware to reproduce, so cannot
confirm if this addresses that issue or not.
Fixes: 98ad145db61a ("net: lwip: add DHCP support and dhcp commmand")
Signed-off-by: Andrew Goodbody <[email protected]>
---
net/lwip/dhcp.c | 6 +++---
net/lwip/net-lwip.c | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/lwip/dhcp.c b/net/lwip/dhcp.c
index
b798014ebcb97dee688e29ccb34da916296c6772..731b57de3ba4336a22fee5957b6e2163360d78a1
100644
--- a/net/lwip/dhcp.c
+++ b/net/lwip/dhcp.c
@@ -30,9 +30,9 @@ static void call_lwip_dhcp_fine_tmr(void *ctx)
static int dhcp_loop(struct udevice *udev)
{
- char ipstr[] = "ipaddr\0\0";
- char maskstr[] = "netmask\0\0";
- char gwstr[] = "gatewayip\0\0";
+ char ipstr[] = "ipaddr\0\0\0";
+ char maskstr[] = "netmask\0\0\0";
+ char gwstr[] = "gatewayip\0\0\0";
const ip_addr_t *ntpserverip;
unsigned long start;
struct netif *netif;
diff --git a/net/lwip/net-lwip.c b/net/lwip/net-lwip.c
index
8741f65fe12e23cc30068506453a762533f8a67f..0fa33730a636727d0718625215a69002242810d0
100644
--- a/net/lwip/net-lwip.c
+++ b/net/lwip/net-lwip.c
@@ -108,9 +108,9 @@ struct netif *net_lwip_get_netif(void)
static int get_udev_ipv4_info(struct udevice *dev, ip4_addr_t *ip,
ip4_addr_t *mask, ip4_addr_t *gw)
{
- char ipstr[] = "ipaddr\0\0";
- char maskstr[] = "netmask\0\0";
- char gwstr[] = "gatewayip\0\0";
+ char ipstr[] = "ipaddr\0\0\0";
+ char maskstr[] = "netmask\0\0\0";
+ char gwstr[] = "gatewayip\0\0\0";
int idx = dev_seq(dev);
char *env;
--
2.47.3
