From 234ff54287c1ce1d92eb807eb285adceb1c86b8c Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 11 Mar 2020 10:19:44 +0100 Subject: [PATCH] staging: most: core: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20200311091944.23185-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman --- drivers/staging/most/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/most/core.c b/drivers/staging/most/core.c index 0c4ae69..f6b38d9 100644 --- a/drivers/staging/most/core.c +++ b/drivers/staging/most/core.c @@ -472,7 +472,7 @@ static int print_links(struct device *dev, void *data) list_for_each_entry(c, &iface->p->channel_list, list) { if (c->pipe0.comp) { - offs += snprintf(buf + offs, + offs += scnprintf(buf + offs, PAGE_SIZE - offs, "%s:%s:%s\n", c->pipe0.comp->name, @@ -480,7 +480,7 @@ static int print_links(struct device *dev, void *data) dev_name(&c->dev)); } if (c->pipe1.comp) { - offs += snprintf(buf + offs, + offs += scnprintf(buf + offs, PAGE_SIZE - offs, "%s:%s:%s\n", c->pipe1.comp->name, @@ -519,7 +519,7 @@ static ssize_t components_show(struct device_driver *drv, char *buf) int offs = 0; list_for_each_entry(comp, &comp_list, list) { - offs += snprintf(buf + offs, PAGE_SIZE - offs, "%s\n", + offs += scnprintf(buf + offs, PAGE_SIZE - offs, "%s\n", comp->name); } return offs; -- 2.7.4