On 07/18/2013 12:28 PM, Chen Gang wrote: > >> strcpy(fmt1, fmt); >> @@ -199,46 +214,51 @@ static void prepare_error_buf(const char *fmt, va_list args) >> while ((k = is_there_reiserfs_struct(fmt1, &what)) != NULL) { >> *k = 0; >> >> - p += vsprintf(p, fmt1, args); >> + p += vsnprintf(p, left, fmt1, args); At least, need use vscnprintf() instead of vsnprintf(), since we need the real written length return. >> + left = REISERFS_ERR_BUF_LEFT(p, error_buf); >> >> switch (what) { >> case 'k': >> - sprintf_le_key(p, va_arg(args, struct reiserfs_key *)); >> + sprintf_le_key(p, left, >> + va_arg(args, struct reiserfs_key *)); >> break; >> case 'K': >> - sprintf_cpu_key(p, va_arg(args, struct cpu_key *)); >> + sprintf_cpu_key(p, left, >> -- Chen Gang -- To unsubscribe from this list: send the line "unsubscribe reiserfs-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html