[PATCH] usb: Expand buffer size in usb_find_and_bind_driver()

[PATCH] usb: Expand buffer size in usb_find_and_bind_driver()

[Marek Vasut]

The "generic_bus_%x_dev_%x" string which is printed into this buffer
can be up to 34 characters long ("generic_bus_12345678_dev_12345678").
The buffer would be clipped by snprintf() if both %x were at maximum
range. Make sure the buffer is long enough to cover such possibility.

Signed-off-by: Marek Vasut <marex@denx.de>
---
Cc: Sean Anderson <sean.anderson@seco.com>
Cc: Simon Glass <sjg@chromium.org>
---
 drivers/usb/host/usb-uclass.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/usb-uclass.c b/drivers/usb/host/usb-uclass.c
index 27e2fc6fcd3..060f3441df0 100644
--- a/drivers/usb/host/usb-uclass.c
+++ b/drivers/usb/host/usb-uclass.c
@@ -557,7 +557,7 @@ static int usb_find_and_bind_driver(struct udevice *parent,
 	struct usb_driver_entry *start, *entry;
 	int n_ents;
 	int ret;
-	char name[30], *str;
+	char name[34], *str;
 	ofnode node = usb_get_ofnode(parent, port);
 
 	*devp = NULL;
-- 
2.35.1

Re: [PATCH] usb: Expand buffer size in usb_find_and_bind_driver()

[Simon Glass]

On Sun, 27 Nov 2022 at 01:58, Marek Vasut <marex@denx.de> wrote:
>
> The "generic_bus_%x_dev_%x" string which is printed into this buffer
> can be up to 34 characters long ("generic_bus_12345678_dev_12345678").
> The buffer would be clipped by snprintf() if both %x were at maximum
> range. Make sure the buffer is long enough to cover such possibility.
>
> Signed-off-by: Marek Vasut <marex@denx.de>
> ---
> Cc: Sean Anderson <sean.anderson@seco.com>
> Cc: Simon Glass <sjg@chromium.org>
> ---
>  drivers/usb/host/usb-uclass.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>

Reviewed-by: Simon Glass <sjg@chromium.org>