liebherr: btt: Fix buffer overflow in board_fit_config_name_match

The maximum length of the board name is not 11 characters
but 14: 11 bytes for the prefix + 3 bytes for the u8 + 1 NULL byte.
Hence, this commit increases the size of the name buffer variable
to 15. Also, this commit fixes the format specifier for the rev_id
variable.

Signed-off-by: Francois Berder <fberder@outlook.fr>

diff --git a/board/liebherr/btt/btt.c b/board/liebherr/btt/btt.c
index c4b6c37e4959be56f8c678c940f33a42c66f71f0..dc683bd082ad8b18cef9864196a8ac5d155c4164 100644 (file)
--- a/board/liebherr/btt/btt.c
+++ b/board/liebherr/btt/btt.c
@@ -393,9 +393,9 @@ int board_fdt_blob_setup(void **fdtp)
 int board_fit_config_name_match(const char *name)
 {
        u8 rev_id = get_som_rev();
-       char board[12];
+       char board[15];
 
-       sprintf(board, "imx28-btt3-%d", rev_id);
+       sprintf(board, "imx28-btt3-%u", rev_id);
 
        if (!strncmp(name, board, sizeof(board)))
                return 0;