]> git.ipfire.org Git - thirdparty/u-boot.git/commit
net: lwip: dhcp: Do not write past end of buffer
authorAndrew Goodbody <andrew.goodbody@linaro.org>
Wed, 14 Jan 2026 15:12:10 +0000 (15:12 +0000)
committerJerome Forissier <jerome.forissier@arm.com>
Wed, 4 Feb 2026 08:04:36 +0000 (09:04 +0100)
commit72d4e94b2ec3099a312c85c4b8f5cdbc920416ff
treeb4dc1e7198304aa820b5ea856f2ab6e113d187b5
parent8df6b78746ee1f4f0bb750aec9c4da2fb31d3e33
net: lwip: dhcp: Do not write past end of buffer

sprintf will write a trailing \0 at the end of the string so when
writing into a buffer, that buffer must be sized to allow for that
trailing zero. In the DHCP code when the index is a number needing two
digits to express the index would use up the two \0 bytes in the buffer
and the trailing \0 from sprintf would be beyond the end of the
allocation. Fix this by adding a third \0 in the buffer.

This was found by code inspection when looking for an issue reported by
Michal Simek, but I do not have the hardware to reproduce, so cannot
confirm if this addresses that issue or not.

Fixes: 98ad145db61a ("net: lwip: add DHCP support and dhcp commmand")
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
net/lwip/dhcp.c
net/lwip/net-lwip.c