Commit 8d8a50e2 authored by Takashi Iwai's avatar Takashi Iwai Committed by Keith Busch
Browse files

nvme-fabrics: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent 764e9332

drivers/nvme/host/fabrics.c

+4 −4
Original line number Diff line number Diff line
@@ -105,14 +105,14 @@ int nvmf_get_address(struct nvme_ctrl *ctrl, char *buf, int size) 
	int len = 0;



	if (ctrl->opts->mask & NVMF_OPT_TRADDR)

		len += snprintf(buf, size, "traddr=%s", ctrl->opts->traddr);

		len += scnprintf(buf, size, "traddr=%s", ctrl->opts->traddr);

	if (ctrl->opts->mask & NVMF_OPT_TRSVCID)

		len += snprintf(buf + len, size - len, "%strsvcid=%s",

		len += scnprintf(buf + len, size - len, "%strsvcid=%s",

				(len) ? "," : "", ctrl->opts->trsvcid);

	if (ctrl->opts->mask & NVMF_OPT_HOST_TRADDR)

		len += snprintf(buf + len, size - len, "%shost_traddr=%s",

		len += scnprintf(buf + len, size - len, "%shost_traddr=%s",

				(len) ? "," : "", ctrl->opts->host_traddr);

	len += snprintf(buf + len, size - len, "\n");

	len += scnprintf(buf + len, size - len, "\n");



	return len;

}