提交 23ab5261 编写于 作者: T Takashi Iwai 提交者: Jason Gunthorpe

IB/hfi1: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the actual
output size, the succeeding calls may go beyond the given buffer limit.
Fix it by replacing with scnprintf().

Link: https://lore.kernel.org/r/20200319154641.23711-1-tiwai@suse.deSigned-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
上级 987914ab
...@@ -222,11 +222,11 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf, ...@@ -222,11 +222,11 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf,
while (bit < bitsize) { while (bit < bitsize) {
zero = find_next_zero_bit(fault->opcodes, bitsize, bit); zero = find_next_zero_bit(fault->opcodes, bitsize, bit);
if (zero - 1 != bit) if (zero - 1 != bit)
size += snprintf(data + size, size += scnprintf(data + size,
datalen - size - 1, datalen - size - 1,
"0x%lx-0x%lx,", bit, zero - 1); "0x%lx-0x%lx,", bit, zero - 1);
else else
size += snprintf(data + size, size += scnprintf(data + size,
datalen - size - 1, "0x%lx,", datalen - size - 1, "0x%lx,",
bit); bit);
bit = find_next_bit(fault->opcodes, bitsize, zero); bit = find_next_bit(fault->opcodes, bitsize, zero);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册