commit 50b3995d027b53f24bbba099b3b6884d5845b614
author Bruce Beare <brucex.j.beare@intel.com> Thu Jul 15 08:52:01 2010 -0700
committer Bruce Beare <brucex.j.beare@intel.com> Thu Jul 15 08:52:01 2010 -0700
tree 2b8b01281752c3ee2e4d32a35bcca63a9f0bd69e
parent bedaac52a677c152e051c17ef456cc9e43f3812b

Check fastboot oem command line length

Change-Id: I301af09c4ec460c9049b75cc7f4d2c50cfe00ceb
Signed-off-by: Bruce Beare <brucex.j.beare@intel.com>

fastboot/engine.c

diff --git a/fastboot/engine.c b/fastboot/engine.c
index 6d62c6e..dc74417 100644
--- a/fastboot/engine.c
+++ b/fastboot/engine.c
@@ -97,14 +97,20 @@
 {
     Action *a;
     va_list ap;
+    size_t cmdsize;
 
     a = calloc(1, sizeof(Action));
     if (a == 0) die("out of memory");
 
     va_start(ap, fmt);
-    vsprintf(a->cmd, fmt, ap);
+    cmdsize = vsnprintf(a->cmd, sizeof(a->cmd), fmt, ap);
     va_end(ap);
 
+    if (cmdsize >= sizeof(a->cmd)) {
+        free(a);
+        die("Command length (%d) exceeds maximum size (%d)", cmdsize, sizeof(a->cmd));
+    }
+
     if (action_last) {
         action_last->next = a;
     } else {