Use sscanf with bounded %s

Change-Id: I549ac093a792fb866fee1d677e85e1e0857e258d

diff --git a/webprobe/webprobe_debugfs.c b/webprobe/webprobe_debugfs.c
index a27263b..f6fa06b 100644 (file)
--- a/webprobe/webprobe_debugfs.c
+++ b/webprobe/webprobe_debugfs.c
@@ -96,6 +96,7 @@ static ssize_t write_app_info(struct file *file, const char __user *user_buf,
 {
        int ret = 0;
        char *buf, *path, *id;
+       char pattern[64];
        int n;
 
        if (count > max_count)
@@ -124,7 +125,9 @@ static ssize_t write_app_info(struct file *file, const char __user *user_buf,
                goto free_path;
        }
 
-       n = sscanf(buf, "%s %s", path, id);
+       snprintf(pattern, sizeof(pattern), "%%%ds %%%ds", count - 1, count - 1);
+
+       n = sscanf(buf, pattern, path, id);
 
        if (n != 2) {
                ret = -EINVAL;