fix %c $string substitution

Fix udev_rules_apply_format() to give error messages for unknown
format elements and pass such elements to the output string
unmodified.

When truncating the substitution string to the length specified in the
format string, head[len] = '\0' could write outside the buffer if that
length was too large.

1 files changed, 5 insertions, 1 deletions

diff --git a/udev_rules.c b/udev_rules.c
index edaaa71d12..d1c3f042c3 100644
--- a/udev_rules.c
+++ b/udev_rules.c
@@ -364,6 +364,8 @@ void udev_rules_apply_format(struct udevice *udev, char *string, size_t maxsize)
 						goto found;
 					}
 				}
+				head[0] = '$';
+				err("unknown format variable '%s'", head);
 			} else if (head[0] == '%') {
 				/* substitute format char */
 				if (head[1] == '\0')
@@ -385,6 +387,8 @@ void udev_rules_apply_format(struct udevice *udev, char *string, size_t maxsize)
 						goto found;
 					}
 				}
+				head[0] = '%';
+				err("unknown format char '%c'", tail[0]);
 			}
 			head++;
 		}
@@ -554,7 +558,7 @@ found:
 			break;
 		}
 		/* possibly truncate to format-char specified length */
-		if (len != -1) {
+		if (len >= 0 && len < (int)strlen(head)) {
 			head[len] = '\0';
 			dbg("truncate to %i chars, subtitution string becomes '%s'", len, head);
 		}