summaryrefslogtreecommitdiff
path: root/drivers/video/fbdev/omap/omapfb_main.c
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2020-03-11 12:32:28 +0300
committerBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>2020-03-20 16:29:04 +0300
commitbf1b615ad97e6ce915b0f510c031803da71b02b8 (patch)
tree555eec5e1af5363e92058140ab97c4a9304e3f9b /drivers/video/fbdev/omap/omapfb_main.c
parent0666a8d7f6a4530440e59f2d22ed4091f4d3818c (diff)
downloadlinux-bf1b615ad97e6ce915b0f510c031803da71b02b8.tar.xz
video: omapfb: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200311093230.24900-2-tiwai@suse.de
Diffstat (limited to 'drivers/video/fbdev/omap/omapfb_main.c')
-rw-r--r--drivers/video/fbdev/omap/omapfb_main.c14
1 files changed, 7 insertions, 7 deletions
diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
index e8a304f84ea8..1a9d6242916e 100644
--- a/drivers/video/fbdev/omap/omapfb_main.c
+++ b/drivers/video/fbdev/omap/omapfb_main.c
@@ -1247,7 +1247,7 @@ static ssize_t omapfb_show_caps_num(struct device *dev,
size = 0;
while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) {
omapfb_get_caps(fbdev, plane, &caps);
- size += snprintf(&buf[size], PAGE_SIZE - size,
+ size += scnprintf(&buf[size], PAGE_SIZE - size,
"plane#%d %#010x %#010x %#010x\n",
plane, caps.ctrl, caps.plane_color, caps.wnd_color);
plane++;
@@ -1268,28 +1268,28 @@ static ssize_t omapfb_show_caps_text(struct device *dev,
size = 0;
while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) {
omapfb_get_caps(fbdev, plane, &caps);
- size += snprintf(&buf[size], PAGE_SIZE - size,
+ size += scnprintf(&buf[size], PAGE_SIZE - size,
"plane#%d:\n", plane);
for (i = 0; i < ARRAY_SIZE(ctrl_caps) &&
size < PAGE_SIZE; i++) {
if (ctrl_caps[i].flag & caps.ctrl)
- size += snprintf(&buf[size], PAGE_SIZE - size,
+ size += scnprintf(&buf[size], PAGE_SIZE - size,
" %s\n", ctrl_caps[i].name);
}
- size += snprintf(&buf[size], PAGE_SIZE - size,
+ size += scnprintf(&buf[size], PAGE_SIZE - size,
" plane colors:\n");
for (i = 0; i < ARRAY_SIZE(color_caps) &&
size < PAGE_SIZE; i++) {
if (color_caps[i].flag & caps.plane_color)
- size += snprintf(&buf[size], PAGE_SIZE - size,
+ size += scnprintf(&buf[size], PAGE_SIZE - size,
" %s\n", color_caps[i].name);
}
- size += snprintf(&buf[size], PAGE_SIZE - size,
+ size += scnprintf(&buf[size], PAGE_SIZE - size,
" window colors:\n");
for (i = 0; i < ARRAY_SIZE(color_caps) &&
size < PAGE_SIZE; i++) {
if (color_caps[i].flag & caps.wnd_color)
- size += snprintf(&buf[size], PAGE_SIZE - size,
+ size += scnprintf(&buf[size], PAGE_SIZE - size,
" %s\n", color_caps[i].name);
}