diff options
author | Ahmad Fatoum <a.fatoum@pengutronix.de> | 2019-08-23 11:25:31 +0200 |
---|---|---|
committer | Sascha Hauer <s.hauer@pengutronix.de> | 2019-09-02 09:12:30 +0200 |
commit | 75a74b5c107b3bc30f9c3836208f4c17f9309eed (patch) | |
tree | 7e26a790234943bf84c46a1bd37ce4c84f84ed3c /common/ratp/ratp.c | |
parent | d421771bcea063b9bce551e06552067b9074d015 (diff) | |
download | barebox-75a74b5c107b3bc30f9c3836208f4c17f9309eed.tar.gz barebox-75a74b5c107b3bc30f9c3836208f4c17f9309eed.tar.xz |
console: fix out-of-bounds read in dputc(/dev/*, ...)
Trying to output a single character via
echo -a /dev/serial0-1
currently results in garbage output after the newline, because console.c's
fops_write discards the buffer length and passes the buffer to
(struct cdev)::puts which only handles NUL-terminated strings.
Fix this by amending (struct cdev)::puts with a new nbytes parameter,
which is correctly propagated. All this functions now return at most the
nbytes parameter they were passed in. This fixes __console_puts, which
used to count new lines twice in its return value.
Fixes: b4f55fcf35 ("console: expose consoles in devfs")
Cc: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'common/ratp/ratp.c')
-rw-r--r-- | common/ratp/ratp.c | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/common/ratp/ratp.c b/common/ratp/ratp.c index 9aea1786d6..e84ad22167 100644 --- a/common/ratp/ratp.c +++ b/common/ratp/ratp.c @@ -259,19 +259,17 @@ static int ratp_console_tstc(struct console_device *cdev) return kfifo_len(ctx->console_recv_fifo) ? 1 : 0; } -static int ratp_console_puts(struct console_device *cdev, const char *s) +static int ratp_console_puts(struct console_device *cdev, const char *s, + size_t nbytes) { struct ratp_ctx *ctx = container_of(cdev, struct ratp_ctx, ratp_console); - int len = 0; - - len = strlen(s); if (ratp_busy(&ctx->ratp)) - return len; + return nbytes; - kfifo_put(ctx->console_transmit_fifo, s, len); + kfifo_put(ctx->console_transmit_fifo, s, nbytes); - return len; + return nbytes; } static void ratp_console_putc(struct console_device *cdev, char c) |