To ensuring that the firmware_tag is properly null-terminated. When copying firmware tag strings to prevent buffer overflows and ensure data integrity.

The maximum size of tag is GB_FIRMWARE_U_TAG_MAX_SIZE = 10 bytes, and it may or may not be NULL-terminated. included in "greybus_firmware.h"

changes has been made at 3 positions: 1: update firmware tag 2: backend update firmware tag 3: backend update firmware tag with unipro

Signed-off-by: Rujra Bhatt braker.noob.kernel@gmail.com --- drivers/staging/greybus/Documentation/firmware/firmware.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/greybus/Documentation/firmware/firmware.c b/drivers/staging/greybus/Documentation/firmware/firmware.c index 765d69faa..f37904b91 100644 --- a/drivers/staging/greybus/Documentation/firmware/firmware.c +++ b/drivers/staging/greybus/Documentation/firmware/firmware.c @@ -63,7 +63,7 @@ static int update_intf_firmware(int fd) intf_load.major = 0; intf_load.minor = 0;

- strncpy((char *)&intf_load.firmware_tag, firmware_tag, + strscpy((char *)&intf_load.firmware_tag, firmware_tag, GB_FIRMWARE_U_TAG_MAX_SIZE);

ret = ioctl(fd, FW_MGMT_IOC_INTF_LOAD_AND_VALIDATE, &intf_load); @@ -101,7 +101,7 @@ static int update_backend_firmware(int fd) /* Get Backend Firmware Version */ printf("Getting Backend Firmware Version\n");

- strncpy((char *)&backend_fw_info.firmware_tag, firmware_tag, + strscpy((char *)&backend_fw_info.firmware_tag, firmware_tag, GB_FIRMWARE_U_TAG_MAX_SIZE);

retry_fw_version: @@ -129,7 +129,7 @@ static int update_backend_firmware(int fd) /* Try Backend Firmware Update over Unipro */ printf("Updating Backend Firmware\n");

- strncpy((char *)&backend_update.firmware_tag, firmware_tag, + strscpy((char *)&backend_update.firmware_tag, firmware_tag, GB_FIRMWARE_U_TAG_MAX_SIZE);

retry_fw_update: -- 2.43.0