From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Date: Wed, 16 Apr 2014 14:25:16 +0300 > This buffer over was detected using static analysis: > > drivers/isdn/icn/icn.c:1325 icn_command() > error: format string overflow. buf_size: 60 length: 98 > > The calculation for the length of the string is off because it assumes > that the dial[] buffer holds a 50 character string, but actually it is > at most 31 characters and NUL. I have removed the dial[] buffer because > it isn't needed. > > The maximum length of the string is actually 79 characters and a NUL. I > have made the cbuf[] array large enough to hold it and changed the > sprintf() to an snprintf() as a further safety enhancement. > > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Applied, thanks Dan. -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
