[PATCH] staging: most: core: Use scnprintf() for avoiding potential buffer overflow

Takashi Iwai tiwai at suse.de
Wed Mar 11 09:19:44 UTC 2020


Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai at suse.de>
---
 drivers/staging/most/core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/most/core.c b/drivers/staging/most/core.c
index 0c4ae6920d77..f6b38d9d57e6 100644
--- a/drivers/staging/most/core.c
+++ b/drivers/staging/most/core.c
@@ -472,7 +472,7 @@ static int print_links(struct device *dev, void *data)
 
 	list_for_each_entry(c, &iface->p->channel_list, list) {
 		if (c->pipe0.comp) {
-			offs += snprintf(buf + offs,
+			offs += scnprintf(buf + offs,
 					 PAGE_SIZE - offs,
 					 "%s:%s:%s\n",
 					 c->pipe0.comp->name,
@@ -480,7 +480,7 @@ static int print_links(struct device *dev, void *data)
 					 dev_name(&c->dev));
 		}
 		if (c->pipe1.comp) {
-			offs += snprintf(buf + offs,
+			offs += scnprintf(buf + offs,
 					 PAGE_SIZE - offs,
 					 "%s:%s:%s\n",
 					 c->pipe1.comp->name,
@@ -519,7 +519,7 @@ static ssize_t components_show(struct device_driver *drv, char *buf)
 	int offs = 0;
 
 	list_for_each_entry(comp, &comp_list, list) {
-		offs += snprintf(buf + offs, PAGE_SIZE - offs, "%s\n",
+		offs += scnprintf(buf + offs, PAGE_SIZE - offs, "%s\n",
 				 comp->name);
 	}
 	return offs;
-- 
2.16.4



More information about the devel mailing list