diff options
| author | Takashi Iwai <tiwai@suse.de> | 2020-03-11 10:32:28 +0100 |
|---|---|---|
| committer | Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> | 2020-03-20 14:29:04 +0100 |
| commit | bf1b615ad97e6ce915b0f510c031803da71b02b8 (patch) | |
| tree | 555eec5e1af5363e92058140ab97c4a9304e3f9b /drivers/video/fbdev/omap/omapfb_main.c | |
| parent | drm/virtio: fix OOB in virtio_gpu_object_create (diff) | |
| download | linux-bf1b615ad97e6ce915b0f510c031803da71b02b8.tar.xz linux-bf1b615ad97e6ce915b0f510c031803da71b02b8.zip | |
video: omapfb: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit. Fix it by replacing with scnprintf().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200311093230.24900-2-tiwai@suse.de
Diffstat (limited to 'drivers/video/fbdev/omap/omapfb_main.c')
| -rw-r--r-- | drivers/video/fbdev/omap/omapfb_main.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c index e8a304f84ea8..1a9d6242916e 100644 --- a/drivers/video/fbdev/omap/omapfb_main.c +++ b/drivers/video/fbdev/omap/omapfb_main.c @@ -1247,7 +1247,7 @@ static ssize_t omapfb_show_caps_num(struct device *dev, size = 0; while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) { omapfb_get_caps(fbdev, plane, &caps); - size += snprintf(&buf[size], PAGE_SIZE - size, + size += scnprintf(&buf[size], PAGE_SIZE - size, "plane#%d %#010x %#010x %#010x\n", plane, caps.ctrl, caps.plane_color, caps.wnd_color); plane++; @@ -1268,28 +1268,28 @@ static ssize_t omapfb_show_caps_text(struct device *dev, size = 0; while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) { omapfb_get_caps(fbdev, plane, &caps); - size += snprintf(&buf[size], PAGE_SIZE - size, + size += scnprintf(&buf[size], PAGE_SIZE - size, "plane#%d:\n", plane); for (i = 0; i < ARRAY_SIZE(ctrl_caps) && size < PAGE_SIZE; i++) { if (ctrl_caps[i].flag & caps.ctrl) - size += snprintf(&buf[size], PAGE_SIZE - size, + size += scnprintf(&buf[size], PAGE_SIZE - size, " %s\n", ctrl_caps[i].name); } - size += snprintf(&buf[size], PAGE_SIZE - size, + size += scnprintf(&buf[size], PAGE_SIZE - size, " plane colors:\n"); for (i = 0; i < ARRAY_SIZE(color_caps) && size < PAGE_SIZE; i++) { if (color_caps[i].flag & caps.plane_color) - size += snprintf(&buf[size], PAGE_SIZE - size, + size += scnprintf(&buf[size], PAGE_SIZE - size, " %s\n", color_caps[i].name); } - size += snprintf(&buf[size], PAGE_SIZE - size, + size += scnprintf(&buf[size], PAGE_SIZE - size, " window colors:\n"); for (i = 0; i < ARRAY_SIZE(color_caps) && size < PAGE_SIZE; i++) { if (color_caps[i].flag & caps.wnd_color) - size += snprintf(&buf[size], PAGE_SIZE - size, + size += scnprintf(&buf[size], PAGE_SIZE - size, " %s\n", color_caps[i].name); } |