From: Francois Berder <fberder@outlook.fr>
Date: Thu, 5 Mar 2026 16:40:05 +0000 (+0100)
Subject: liebherr: btt: Fix buffer overflow in board_fit_config_name_match
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=262258dc75f2e07c2ab7a830656eae94ab4a8be9;p=thirdparty%2Fu-boot.git

liebherr: btt: Fix buffer overflow in board_fit_config_name_match

The maximum length of the board name is not 11 characters
but 14: 11 bytes for the prefix + 3 bytes for the u8 + 1 NULL byte.
Hence, this commit increases the size of the name buffer variable
to 15. Also, this commit fixes the format specifier for the rev_id
variable.

Signed-off-by: Francois Berder <fberder@outlook.fr>
---

diff --git a/board/liebherr/btt/btt.c b/board/liebherr/btt/btt.c
index c4b6c37e495..dc683bd082a 100644
--- a/board/liebherr/btt/btt.c
+++ b/board/liebherr/btt/btt.c
@@ -393,9 +393,9 @@ int board_fdt_blob_setup(void **fdtp)
 int board_fit_config_name_match(const char *name)
 {
 	u8 rev_id = get_som_rev();
-	char board[12];
+	char board[15];
 
-	sprintf(board, "imx28-btt3-%d", rev_id);
+	sprintf(board, "imx28-btt3-%u", rev_id);
 
 	if (!strncmp(name, board, sizeof(board)))
 		return 0;