From: Benedikt Spranger <b.spranger@linutronix.de>
Date: Fri, 18 Oct 2024 08:30:02 +0000 (+0200)
Subject: tiny-printf: Handle NULL pointer argument to %s
X-Git-Tag: v2025.04-rc1~17^2~87^2~5
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f0dab28915b7890d5a7d958bc4b6f9b61f535cb4;p=pandora-u-boot.git

tiny-printf: Handle NULL pointer argument to %s

A NULL pointer argument to %s causes a NULL pointer dereference in the
fixed width numerical printout code, since p is overwritten with NULL.
In case of %s width is 0. Check width before dereferencing the pointer.

Signed-off-by: Benedikt Spranger <b.spranger@linutronix.de>
Reviewed-by: John Ogness <john.ogness@linutronix.de>
---

diff --git a/lib/tiny-printf.c b/lib/tiny-printf.c
index cc1dfe61cf7..0503c17341f 100644
--- a/lib/tiny-printf.c
+++ b/lib/tiny-printf.c
@@ -312,7 +312,7 @@ static int _vprintf(struct printf_info *info, const char *fmt, va_list va)
 
 			*info->bf = 0;
 			info->bf = p;
-			while (*info->bf++ && width > 0)
+			while (width > 0 && info->bf && *info->bf++)
 				width--;
 			while (width-- > 0)
 				info->putc(info, lz ? '0' : ' ');