Skip to content

Commit fe7e77f

Browse files
committed
u-boot: v2026.04: helios64: bound otp.part_num debug print
show_otp_data() printed otp.part_num (a fixed 16-byte field, not a C string) with plain %s. If OTP content lacks a NUL terminator, printf would over-read into the adjacent packed fields. Use %.*s with strnlen(..., sizeof(otp.part_num)) so the output is bounded by both the actual content length and the field size. Only reachable in DEBUG builds, but the UB is real. Suggested-by: coderabbitai[bot]
1 parent 071894b commit fe7e77f

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

  • patch/u-boot/v2026.04/board_helios64/board

patch/u-boot/v2026.04/board_helios64/board/sys_otp.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,9 @@ static void show_otp_data(void)
126126
if (!is_valid_header())
127127
return;
128128

129-
printf("Part Number: %s\n", otp.part_num);
129+
printf("Part Number: %.*s\n",
130+
(int)strnlen((const char *)otp.part_num, sizeof(otp.part_num)),
131+
otp.part_num);
130132
printf("Variant: %s\n",
131133
(otp.variant < BOARD_VARIANT_MAX) ? var_str[otp.variant]
132134
: var_str[BOARD_VARIANT_INVALID]);

0 commit comments

Comments
 (0)