VULNERABILITY DETAILS
Buffer Overflow [CWE-120]

VERSION
ChromeOs Version: Current Stable
Operating System: Chromeos

REPRODUCTION CASE
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an array of integers. Writing outside the bounds of a block of allocated memory can corrupt data, crash the program, or cause the execution of malicious code. 

VULNERABLE CODE
https://android.googlesource.com/platform/system/core/+/froyo/toolbox/syren.c#126

	r = find_reg(argv[2]);
	if (r == NULL) {
		strcpy(name, argv[2]);
		char *addr_str = strchr(argv[2], ':');
		if (addr_str == NULL)
			return usage();
		*addr_str++ = 0;
		sio.page = strtoul(argv[2], 0, 0);
		sio.addr = strtoul(addr_str, 0, 0);
	} else {
		strcpy(name, r->name);
		sio.page = r->page;
		sio.addr = r->addr;
	}

If r returns null and argv[2] is bigger then char name[32] a buffer overflow will occur. Strcpy does not check the size before copying it into name. You're better off using strncpy since that requires you to put a lenght in it.

Kind Regards,

Jordy Zomer