Commit 4345e2e5 authored by Takashi Iwai's avatar Takashi Iwai Committed by Mauro Carvalho Chehab
Browse files

media: rc: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 4b508ed1

drivers/media/rc/nuvoton-cir.c

+2 −2
Original line number Diff line number Diff line
@@ -230,10 +230,10 @@ static ssize_t wakeup_data_show(struct device *dev, 
	for (i = 0; i < fifo_len; i++) {

		duration = nvt_cir_wake_reg_read(nvt, CIR_WAKE_RD_FIFO_ONLY);

		duration = (duration & BUF_LEN_MASK) * SAMPLE_PERIOD;

		buf_len += snprintf(buf + buf_len, PAGE_SIZE - buf_len,

		buf_len += scnprintf(buf + buf_len, PAGE_SIZE - buf_len,

				    "%d ", duration);

	}

	buf_len += snprintf(buf + buf_len, PAGE_SIZE - buf_len, "\n");

	buf_len += scnprintf(buf + buf_len, PAGE_SIZE - buf_len, "\n");



	spin_unlock_irqrestore(&nvt->lock, flags);