| Message ID | 20200311084713.18220-4-tiwai@suse.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 5cb5b4759cf6febe49bf23b7a0f362ac37e21b01 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | wireless: Use scnprintf() for avoiding potential buffer overflow | expand |
Takashi Iwai <tiwai@suse.de> wrote: > Since snprintf() returns the would-be-output size instead of the > actual output size, the succeeding calls may go beyond the given > buffer limit. Fix it by replacing with scnprintf(). > > Cc: Christian Lamparter <chunkeey@googlemail.com> > Signed-off-by: Takashi Iwai <tiwai@suse.de> 5 patches applied to wireless-drivers-next.git, thanks. 5cb5b4759cf6 carl9170: Use scnprintf() for avoiding potential buffer overflow 68b02e0c512b b43: Use scnprintf() for avoiding potential buffer overflow d3f8c708c0d7 b43legacy: Use scnprintf() for avoiding potential buffer overflow f35ba45c39c9 ipw2x00: Use scnprintf() for avoiding potential buffer overflow 1da740e08a2d prism54: Use scnprintf() for avoiding potential buffer overflow
diff --git a/drivers/net/wireless/ath/carl9170/debug.c b/drivers/net/wireless/ath/carl9170/debug.c index a9b6dc17e408..19009aafc4e1 100644 --- a/drivers/net/wireless/ath/carl9170/debug.c +++ b/drivers/net/wireless/ath/carl9170/debug.c @@ -45,7 +45,7 @@ #include "cmd.h" #define ADD(buf, off, max, fmt, args...) \ - off += snprintf(&buf[off], max - off, fmt, ##args); + off += scnprintf(&buf[off], max - off, fmt, ##args); struct carl9170_debugfs_fops {
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Cc: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> --- drivers/net/wireless/ath/carl9170/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)