From 331d75544fc843f93275eb3767753e4a0a712a39 Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Mon, 3 Feb 2025 10:12:02 +0100 Subject: [PATCH] net: use strnstr() for lwip_strnstr() Using strstr() instead of strnstr() creates a security concern. Fixes: 1c41a7afaa15 ("net: lwip: build lwIP") Signed-off-by: Heinrich Schuchardt Reviewed-by: Jerome Forissier Reviewed-by: Ilias Apalodimas Signed-off-by: Jerome Forissier --- lib/lwip/u-boot/arch/cc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/lwip/u-boot/arch/cc.h b/lib/lwip/u-boot/arch/cc.h index de138846358..6104c296f6f 100644 --- a/lib/lwip/u-boot/arch/cc.h +++ b/lib/lwip/u-boot/arch/cc.h @@ -34,7 +34,7 @@ x, __LINE__, __FILE__); } while (0) #define atoi(str) (int)dectoul(str, NULL) -#define lwip_strnstr(a, b, c) strstr(a, b) +#define lwip_strnstr(a, b, c) strnstr(a, b, c) #define LWIP_ERR_T int #define LWIP_CONST_CAST(target_type, val) ((target_type)((uintptr_t)val)) -- 2.39.5