net: ti: icssg: Fix portname buffer overflow

portname consists of dev->parent->name ("icssg0-eth",
"icssg1-eth", or "ethernet") and dev->name is the port node
name ("port@0" or "port@1").  Every board DTS in the repository
produces a string that overflows the buffer:

"icssg1-eth-port@0"  17 chars + NUL = 18 bytes  (AM642 EVM, IoT2050)
"ethernet-port@0"    15 chars + NUL = 16 bytes  (SR-SOM, phyboard)

This commits increases portname to 64 bytes and replaces sprintf
by snprintf so that any future DT node name cannot overflow it
regardless of length.

Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>

diff --git a/drivers/net/ti/icssg_prueth.c b/drivers/net/ti/icssg_prueth.c
index 12a162b9d688d604429953b14d50a901ae744cf3..4796d0d67cd6257852f25c811ddde66acc2bc5c9 100644 (file)
--- a/drivers/net/ti/icssg_prueth.c
+++ b/drivers/net/ti/icssg_prueth.c
@@ -496,14 +496,15 @@ static int prueth_port_probe(struct udevice *dev)
 {
        struct prueth_priv *priv = dev_get_priv(dev);
        struct prueth *prueth;
-       char portname[15];
+       char portname[64];
        int ret;
 
        priv->dev = dev;
        prueth = dev_get_priv(dev->parent);
        priv->prueth = prueth;
 
-       sprintf(portname, "%s-%s", dev->parent->name, dev->name);
+       snprintf(portname, sizeof(portname), "%s-%s", dev->parent->name, dev->name);
+       portname[sizeof(portname) - 1] = '\0';
 
        device_set_name(dev, portname);