Fix out of bounds memory access
authorThomas Jarosch <thomas.jarosch@intra2net.com>
Tue, 25 Dec 2012 17:06:57 +0000 (18:06 +0100)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Sun, 6 Jan 2013 17:20:47 +0000 (18:20 +0100)
cppcheck reported:
[tools/intel_infoframes.c:836]: (error) Width 31 given in format string
(no. 1) is larger than destination buffer 'option[16]',
use %15s to prevent overflowing it.

Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
tools/intel_infoframes.c

index 66351ac..09fdcb9 100644 (file)
@@ -833,7 +833,7 @@ static void change_spd_infoframe(Transcoder transcoder, char *commands)
        val = INREG(reg);
 
        while (1) {
-               rc = sscanf(current, "%31s%n", option, &read);
+               rc = sscanf(current, "%15s%n", option, &read);
                current = &current[read];
                if (rc == EOF) {
                        break;