提交 74dcd439 编写于 作者: L Lars-Peter Clausen 提交者: Greg Kroah-Hartman

iio: iio_enum_available_read: Prevent possible buffer overflow

Use scnprint instead of snprintf, because snprintf returns the number of bytes
that would have been written to the buffer if there was enough space, and as a
result writing to buf[len-1] might cause a access beyond the buffers limits.
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
上级 a21e6bfe
......@@ -300,7 +300,7 @@ ssize_t iio_enum_available_read(struct iio_dev *indio_dev,
return 0;
for (i = 0; i < e->num_items; ++i)
len += snprintf(buf + len, PAGE_SIZE - len, "%s ", e->items[i]);
len += scnprintf(buf + len, PAGE_SIZE - len, "%s ", e->items[i]);
/* replace last space with a newline */
buf[len - 1] = '\n';
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册