From mboxrd@z Thu Jan  1 00:00:00 1970
From: Hoyeonjiki Kim <jigi.kim@gmail.com>
Date: Fri, 13 Nov 2020 13:10:59 +0900
Subject: [PATCH] env: mmc: Correct partition comparison in
 mmc_offset_try_partition
In-Reply-To: <10730.1605211591@gemini.denx.de>
References: <20201112123026.458-1-jigi.kim@gmail.com>
 <10730.1605211591@gemini.denx.de>
Message-ID: <CAL9K-_h=j0Sn7U=0=wJ_cp7cGecn0MMmnLkJidRYqw4ijzE39g@mail.gmail.com>
List-Id: <u-boot.lists.denx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: u-boot@lists.denx.de

On Fri, Nov 13, 2020 at 5:06 AM Wolfgang Denk <wd@denx.de> wrote:
>
> Dear Hoyeonjiki Kim,
>
> In message <20201112123026.458-1-jigi.kim@gmail.com> you wrote:
> > The function mmc_offset_try_partition searches MMC partition to save the
> > environment data by name.  However, it only compares the first word-size
> > bytes (size of 'const char *'), which may make the function to find
> > unintended partition.
> >
> > Correct the function not to partially compare the partition name with
> > config "u-boot,mmc-env-partition".
> >
> > Fixes: c9e87ba66540 ("env: Save environment at the end of an MMC partition")
> > Signed-off-by: Hoyeonjiki Kim <jigi.kim@gmail.com>
> > Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
> > ---
> >  env/mmc.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/env/mmc.c b/env/mmc.c
> > index 4e67180b23..505f7aa2b8 100644
> > --- a/env/mmc.c
> > +++ b/env/mmc.c
> > @@ -42,7 +42,7 @@ static inline int mmc_offset_try_partition(const char *str, int copy, s64 *val)
> >               if (ret < 0)
> >                       return ret;
> >
> > -             if (!strncmp((const char *)info.name, str, sizeof(str)))
> > +             if (!strcmp((const char *)info.name, str))
>
> This looks dangerous to me.  If the used length  sizeof(str) is not
> correct, that should be fixed, but switching to strcmp() means we
> may run into problems if the buffer is not NUL terminated.  Do we
> have a guarantee here thai it always ist??  The fact that strncmp()
> has been used before suggests otyherwise.
>
> Please double-check.
>
> Best regards,
>
> Wolfgang Denk
>
> --
> DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
> HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
> Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
> Computers are not intelligent. They only think they are.

Dear Wolfgang Denk,

I left my reply on the thread for patch v2.
Please refer to that.

We can keep discussing it on that thread from now on.
Again, sorry for the confusion.

Best Regards,
Hoyeonjiki Kim