Christophe JAILLET, le lun. 04 sept. 2023 21:31:44 +0200, a ecrit:
> snprintf() returns the "number of characters which *would* be generated for
> the given input", not the size *really* generated.
>
> In order to avoid too large values for 'len' (and potential negative
> values for "sizeof(buf) - (len - 1)") use scnprintf() instead of
> snprintf().
>
> Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@xxxxxxxxxx>
Reviewed-by: Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>
Thanks!
> ---
> I guess that the -1 in the 2nd snprintf() call is here to overwrite the
> ending \n.
> ---
> drivers/accessibility/speakup/kobjects.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/accessibility/speakup/kobjects.c b/drivers/accessibility/speakup/kobjects.c
> index a7522d409802..1eea7c492875 100644
> --- a/drivers/accessibility/speakup/kobjects.c
> +++ b/drivers/accessibility/speakup/kobjects.c
> @@ -92,9 +92,9 @@ static void report_char_chartab_status(int reset, int received, int used,
> if (reset) {
> pr_info("%s reset to defaults\n", object_type[do_characters]);
> } else if (received) {
> - len = snprintf(buf, sizeof(buf),
> - " updated %d of %d %s\n",
> - used, received, object_type[do_characters]);
> + len = scnprintf(buf, sizeof(buf),
> + " updated %d of %d %s\n",
> + used, received, object_type[do_characters]);
> if (rejected)
> snprintf(buf + (len - 1), sizeof(buf) - (len - 1),
> " with %d reject%s\n",
> --
> 2.34.1
