Two independent fixes to the xilinx vendor common board file, both found while bringing a downstream Versal NET board up to date with mainline.
Patch 1 fixes a heap buffer overflow in board_name_decode(). The name is built with strcat() into a 50 byte allocation, and the length check that is supposed to catch the overflow only runs after the writes. Each EEPROM descriptor can contribute up to 29 characters, so a base board plus a carrier card already overruns the buffer with EEPROM-supplied data. Patch 2 marks ft_board_setup() __weak so that a board using the xilinx vendor common library can supply its own device tree fixups, the same way the file already allows board_name_decode(), board_detection(), soc_detection() and board_rng_seed() to be overridden. Today such a board fails to link with "multiple definition of ft_board_setup". Both patches were build tested on xilinx_zynqmp_kria_defconfig, which enables CONFIG_DTB_RESELECT and CONFIG_OF_BOARD_SETUP and so compiles both of the changed functions. Drew Kluemke (1): board: xilinx: Use strlcat() in board_name_decode() Sriram Sriram (1): board: xilinx: Make ft_board_setup() weak board/xilinx/common/board.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) -- 2.49.0
