[PATCH] staging: greybus: Use scnprintf() for avoiding potential buffer overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
---
 drivers/staging/greybus/tools/loopback_test.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/staging/greybus/tools/loopback_test.c b/drivers/staging/greybus/tools/loopback_test.c
index ba6f905f26fa..0b95a1c2b2e9 100644
--- a/drivers/staging/greybus/tools/loopback_test.c
+++ b/drivers/staging/greybus/tools/loopback_test.c
@@ -426,7 +426,7 @@ int format_output(struct loopback_test *t,
 		       tm->tm_hour, tm->tm_min, tm->tm_sec);
 
 	if (t->porcelain) {
-		len += snprintf(&buf[len], buf_len - len,
+		len += scnprintf(&buf[len], buf_len - len,
 			"\n test:\t\t\t%s\n path:\t\t\t%s\n size:\t\t\t%u\n iterations:\t\t%u\n errors:\t\t%u\n async:\t\t\t%s\n",
 			t->test_name,
 			dev_name,
@@ -435,33 +435,33 @@ int format_output(struct loopback_test *t,
 			r->error,
 			t->use_async ? "Enabled" : "Disabled");
 
-		len += snprintf(&buf[len], buf_len - len,
+		len += scnprintf(&buf[len], buf_len - len,
 			" requests per-sec:\tmin=%u, max=%u, average=%f, jitter=%u\n",
 			r->request_min,
 			r->request_max,
 			r->request_avg,
 			r->request_jitter);
 
-		len += snprintf(&buf[len], buf_len - len,
+		len += scnprintf(&buf[len], buf_len - len,
 			" ap-throughput B/s:\tmin=%u max=%u average=%f jitter=%u\n",
 			r->throughput_min,
 			r->throughput_max,
 			r->throughput_avg,
 			r->throughput_jitter);
-		len += snprintf(&buf[len], buf_len - len,
+		len += scnprintf(&buf[len], buf_len - len,
 			" ap-latency usec:\tmin=%u max=%u average=%f jitter=%u\n",
 			r->latency_min,
 			r->latency_max,
 			r->latency_avg,
 			r->latency_jitter);
-		len += snprintf(&buf[len], buf_len - len,
+		len += scnprintf(&buf[len], buf_len - len,
 			" apbridge-latency usec:\tmin=%u max=%u average=%f jitter=%u\n",
 			r->apbridge_unipro_latency_min,
 			r->apbridge_unipro_latency_max,
 			r->apbridge_unipro_latency_avg,
 			r->apbridge_unipro_latency_jitter);
 
-		len += snprintf(&buf[len], buf_len - len,
+		len += scnprintf(&buf[len], buf_len - len,
 			" gbphy-latency usec:\tmin=%u max=%u average=%f jitter=%u\n",
 			r->gbphy_firmware_latency_min,
 			r->gbphy_firmware_latency_max,
@@ -469,35 +469,35 @@ int format_output(struct loopback_test *t,
 			r->gbphy_firmware_latency_jitter);
 
 	} else {
-		len += snprintf(&buf[len], buf_len - len, ",%s,%s,%u,%u,%u",
+		len += scnprintf(&buf[len], buf_len - len, ",%s,%s,%u,%u,%u",
 			t->test_name, dev_name, t->size, t->iteration_max,
 			r->error);
 
-		len += snprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
+		len += scnprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
 			r->request_min,
 			r->request_max,
 			r->request_avg,
 			r->request_jitter);
 
-		len += snprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
+		len += scnprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
 			r->latency_min,
 			r->latency_max,
 			r->latency_avg,
 			r->latency_jitter);
 
-		len += snprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
+		len += scnprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
 			r->throughput_min,
 			r->throughput_max,
 			r->throughput_avg,
 			r->throughput_jitter);
 
-		len += snprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
+		len += scnprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
 			r->apbridge_unipro_latency_min,
 			r->apbridge_unipro_latency_max,
 			r->apbridge_unipro_latency_avg,
 			r->apbridge_unipro_latency_jitter);
 
-		len += snprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
+		len += scnprintf(&buf[len], buf_len - len, ",%u,%u,%f,%u",
 			r->gbphy_firmware_latency_min,
 			r->gbphy_firmware_latency_max,
 			r->gbphy_firmware_latency_avg,
-- 
2.16.4

_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel



[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux