summaryrefslogtreecommitdiffstats
path: root/drivers/tty
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2020-03-11 10:29:05 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-03-18 12:59:29 +0100
commitcaa47cc639470485ee0ae3c76d56ccf4cfda2045 (patch)
tree7b4cd2091a6c57ab77cb062b5d4abb5c3a70dabb /drivers/tty
parenttty: serial: pch_uart: Use scnprintf() for avoiding potential buffer overflow (diff)
downloadlinux-caa47cc639470485ee0ae3c76d56ccf4cfda2045.tar.xz
linux-caa47cc639470485ee0ae3c76d56ccf4cfda2045.zip
tty: nozomi: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Also rewrite the code in a standard if-form instead of ugly conditional operators. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20200311092905.24362-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty')
-rw-r--r--drivers/tty/nozomi.c67
1 files changed, 33 insertions, 34 deletions
diff --git a/drivers/tty/nozomi.c b/drivers/tty/nozomi.c
index 4b82ec30c789..d42b854cb7df 100644
--- a/drivers/tty/nozomi.c
+++ b/drivers/tty/nozomi.c
@@ -839,40 +839,39 @@ static char *interrupt2str(u16 interrupt)
static char buf[TMP_BUF_MAX];
char *p = buf;
- interrupt & MDM_DL1 ? p += snprintf(p, TMP_BUF_MAX, "MDM_DL1 ") : NULL;
- interrupt & MDM_DL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "MDM_DL2 ") : NULL;
-
- interrupt & MDM_UL1 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "MDM_UL1 ") : NULL;
- interrupt & MDM_UL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "MDM_UL2 ") : NULL;
-
- interrupt & DIAG_DL1 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "DIAG_DL1 ") : NULL;
- interrupt & DIAG_DL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "DIAG_DL2 ") : NULL;
-
- interrupt & DIAG_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "DIAG_UL ") : NULL;
-
- interrupt & APP1_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "APP1_DL ") : NULL;
- interrupt & APP2_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "APP2_DL ") : NULL;
-
- interrupt & APP1_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "APP1_UL ") : NULL;
- interrupt & APP2_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "APP2_UL ") : NULL;
-
- interrupt & CTRL_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "CTRL_DL ") : NULL;
- interrupt & CTRL_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "CTRL_UL ") : NULL;
-
- interrupt & RESET ? p += snprintf(p, TMP_BUF_MAX - (p - buf),
- "RESET ") : NULL;
+ if (interrupt & MDM_DL1)
+ p += scnprintf(p, TMP_BUF_MAX, "MDM_DL1 ");
+ if (interrupt & MDM_DL2)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_DL2 ");
+ if (interrupt & MDM_UL1)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_UL1 ");
+ if (interrupt & MDM_UL2)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_UL2 ");
+ if (interrupt & DIAG_DL1)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_DL1 ");
+ if (interrupt & DIAG_DL2)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_DL2 ");
+
+ if (interrupt & DIAG_UL)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_UL ");
+
+ if (interrupt & APP1_DL)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP1_DL ");
+ if (interrupt & APP2_DL)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP2_DL ");
+
+ if (interrupt & APP1_UL)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP1_UL ");
+ if (interrupt & APP2_UL)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP2_UL ");
+
+ if (interrupt & CTRL_DL)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "CTRL_DL ");
+ if (interrupt & CTRL_UL)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "CTRL_UL ");
+
+ if (interrupt & RESET)
+ p += scnprintf(p, TMP_BUF_MAX - (p - buf), "RESET ");
return buf;
}