[PATCH 4/8] MIPS: txx9: bound command-line reconstruction

[Pengpeng Hou]

The early txx9 command-line builders rebuild arcs_cmdline with repeated
strcat() calls when quoting PROM arguments and when reinserting filtered
arguments after preprocessing. Those append chains do not track the
remaining space in the fixed command-line buffer.

Convert the rebuild steps to bounded concatenation so long firmware
arguments cannot overflow arcs_cmdline.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 arch/mips/txx9/generic/setup.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c
index 6c5025806914..715059d5101e 100644
--- a/arch/mips/txx9/generic/setup.c
+++ b/arch/mips/txx9/generic/setup.c
@@ -128,13 +128,13 @@ static void __init prom_init_cmdline(void)
 	for (i = 1; i < argc; i++) {
 		char *str = (char *)(long)argv32[i];
 		if (i != 1)
-			strcat(arcs_cmdline, " ");
+			strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE);
 		if (strchr(str, ' ')) {
-			strcat(arcs_cmdline, "\"");
-			strcat(arcs_cmdline, str);
-			strcat(arcs_cmdline, "\"");
+			strlcat(arcs_cmdline, "\"", COMMAND_LINE_SIZE);
+			strlcat(arcs_cmdline, str, COMMAND_LINE_SIZE);
+			strlcat(arcs_cmdline, "\"", COMMAND_LINE_SIZE);
 		} else
-			strcat(arcs_cmdline, str);
+			strlcat(arcs_cmdline, str, COMMAND_LINE_SIZE);
 	}
 }
 
@@ -227,8 +227,8 @@ static void __init preprocess_cmdline(void)
 			continue;
 		}
 		if (arcs_cmdline[0])
-			strcat(arcs_cmdline, " ");
-		strcat(arcs_cmdline, str);
+			strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE);
+		strlcat(arcs_cmdline, str, COMMAND_LINE_SIZE);
 	}
 
 	txx9_cache_fixup();
-- 
2.50.1 (Apple Git-155)