getenv_f(): fix handling of too short buffers

Fix error handling in getenv_f() when the user provided buffer is too short to hold the variable name; make sure to truncate and NUL-terminate without overwriting the buffer limits. Signed-off-by: Wolfgang Denk <wd@denx.de>

getenv_f(): fix handling of too short buffers
Fix error handling in getenv_f() when the user provided buffer is too short to hold the variable name; make sure to truncate and NUL-terminate without overwriting the buffer limits. Signed-off-by: Wolfgang Denk <wd@denx.de>
Wolfgang Denk
1 parent 739b8080af
Showing 1 changed file with 12 additions and 6 deletions Side-by-side Diff
common/cmd_nvedit.c
@@ -557,13 +557,19 @@
 		}
 		if ((val=envmatch((uchar *)name, i)) < 0)
 			continue;
+
 		/* found; copy out */
-		n = 0;
-		while ((len > n++) && (*buf++ = env_get_char(val++)) != '\0')
-			;
-		if (len == n)
-			*buf = '\0';
-		return (n);
+		for (n=0; n<len; ++n, ++buf) {
+			if ((*buf = env_get_char(val++)) == '\0')
+				return n;
+		}
+
+		if (n)
+			*--buf = '\0';
+
+		printf("env_buf too small [%d]\n", len);
+
+		return n;
 	}
 	return (-1);
 }
...	...	@@ -557,13 +557,19 @@
557	557	}
558	558	if ((val=envmatch((uchar *)name, i)) < 0)
559	559	continue;
	560	+
560	561	/* found; copy out */
561		- n = 0;
562		- while ((len > n++) && (*buf++ = env_get_char(val++)) != '\0')
563		- ;
564		- if (len == n)
565		- *buf = '\0';
566		- return (n);
	562	+ for (n=0; n<len; ++n, ++buf) {
	563	+ if ((*buf = env_get_char(val++)) == '\0')
	564	+ return n;
	565	+ }
	566	+
	567	+ if (n)
	568	+ *--buf = '\0';
	569	+
	570	+ printf("env_buf too small [%d]\n", len);
	571	+
	572	+ return n;
567	573	}
568	574	return (-1);
569	575	}