From: Vasiliy Kulikov <segoon@xxxxxxxxxxxx> Date: Sun, 14 Nov 2010 20:06:08 +0300 > snprintf() returns number of bytes that were copied if there is no overflow. > This code uses return value as number of copied bytes. Theoretically format > string '%lu.%09lu %pI4:%u %pI4:%u %d %#x %#x %u %u %u %u\n' may be expanded > up to 163 bytes. In reality tv.tv_sec is just few bytes instead of 20, 2 ports > are just 5 bytes each instead of 10, length is 5 bytes instead of 10. The rest > is an unstrusted input. Theoretically if tv_sec is big then copy_to_user() would > overflow tbuf. > > tbuf was increased to fit in 163 bytes. snprintf() is used to follow return > value semantic. > > Signed-off-by: Vasiliy Kulikov <segoon@xxxxxxxxxxxx> Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
