diff options
| author | Takashi Iwai <tiwai@suse.de> | 2020-03-11 10:47:06 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2020-03-20 18:27:42 +0300 |
| commit | 4345e2e5c75895232a17e6783e6233beadc650c4 (patch) | |
| tree | 195cdb7ccccb597417d5aa447bb3e2fbe3575d4e /drivers/media | |
| parent | 4b508ed16acac15f4a762d5e10ed8d64a7ac3fb1 (diff) | |
| download | linux-4345e2e5c75895232a17e6783e6233beadc650c4.tar.xz | |
media: rc: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit. Fix it by replacing with scnprintf().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/rc/nuvoton-cir.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c index 5c2cd8d2d155..48a69bf23236 100644 --- a/drivers/media/rc/nuvoton-cir.c +++ b/drivers/media/rc/nuvoton-cir.c @@ -230,10 +230,10 @@ static ssize_t wakeup_data_show(struct device *dev, for (i = 0; i < fifo_len; i++) { duration = nvt_cir_wake_reg_read(nvt, CIR_WAKE_RD_FIFO_ONLY); duration = (duration & BUF_LEN_MASK) * SAMPLE_PERIOD; - buf_len += snprintf(buf + buf_len, PAGE_SIZE - buf_len, + buf_len += scnprintf(buf + buf_len, PAGE_SIZE - buf_len, "%d ", duration); } - buf_len += snprintf(buf + buf_len, PAGE_SIZE - buf_len, "\n"); + buf_len += scnprintf(buf + buf_len, PAGE_SIZE - buf_len, "\n"); spin_unlock_irqrestore(&nvt->lock, flags); |