summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVincent Palatin <vpalatin@chromium.org>2012-01-13 15:05:34 -0800
committerGerrit <chrome-bot@google.com>2012-01-13 16:00:43 -0800
commitc98691ab0e592a4806607192d12a45a9af69d5a0 (patch)
tree9f0eff67e75b66e12be1733774af171801a90542
parent45a25a37f94d0d3816c97319ed67f320247e26b6 (diff)
stdio: fix stack memory corruption
When copying the device name, the temporary target variable was twice smaller than the copy size. Create a define to ensure this won't break again. Signed-off-by: Vincent Palatin <vpalatin@chromium.org> BUG=chrome-os-partner:7188 chrome-os-partner:7430 chrome-os-partner:7432 chrome-os-partner:7559 TEST=On lumpy with usb keyboard configured, run in recovery mode, insert a bad key, press tab, remove the key, press tab. The recovery info are displayed properly. Change-Id: Ia9e765555d2f4efba81b8c389be2778cf2b92db0 Reviewed-on: https://gerrit.chromium.org/gerrit/14185 Commit-Ready: Vincent Palatin <vpalatin@chromium.org> Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
-rw-r--r--common/stdio.c2
-rw-r--r--include/stdio_dev.h4
2 files changed, 4 insertions, 2 deletions
diff --git a/common/stdio.c b/common/stdio.c
index f64909d9e1c..8b31a7d1f8c 100644
--- a/common/stdio.c
+++ b/common/stdio.c
@@ -160,7 +160,7 @@ int stdio_deregister(const char *devname)
int l;
struct list_head *pos;
struct stdio_dev *dev;
- char temp_names[3][8];
+ char temp_names[MAX_FILES][STDIO_NAME_SIZE];
dev = stdio_get_by_name(devname);
diff --git a/include/stdio_dev.h b/include/stdio_dev.h
index 932d093345e..6ed1f12b873 100644
--- a/include/stdio_dev.h
+++ b/include/stdio_dev.h
@@ -35,11 +35,13 @@
#define DEV_FLAGS_SYSTEM 0x80000000 /* Device is a system device */
#define DEV_EXT_VIDEO 0x00000001 /* Video extensions supported */
+#define STDIO_NAME_SIZE 16
+
/* Device information */
struct stdio_dev {
int flags; /* Device flags: input/output/system */
int ext; /* Supported extensions */
- char name[16]; /* Device name */
+ char name[STDIO_NAME_SIZE]; /* Device name */
/* GENERAL functions */