Commit b40e288b authored by Takashi Iwai's avatar Takashi Iwai Committed by Andy Shevchenko

platform/x86: sony-laptop: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
parent 1d6f8c5b
...@@ -827,10 +827,10 @@ static ssize_t sony_nc_handles_show(struct device *dev, ...@@ -827,10 +827,10 @@ static ssize_t sony_nc_handles_show(struct device *dev,
int i; int i;
for (i = 0; i < ARRAY_SIZE(handles->cap); i++) { for (i = 0; i < ARRAY_SIZE(handles->cap); i++) {
len += snprintf(buffer + len, PAGE_SIZE - len, "0x%.4x ", len += scnprintf(buffer + len, PAGE_SIZE - len, "0x%.4x ",
handles->cap[i]); handles->cap[i]);
} }
len += snprintf(buffer + len, PAGE_SIZE - len, "\n"); len += scnprintf(buffer + len, PAGE_SIZE - len, "\n");
return len; return len;
} }
...@@ -2187,10 +2187,10 @@ static ssize_t sony_nc_thermal_profiles_show(struct device *dev, ...@@ -2187,10 +2187,10 @@ static ssize_t sony_nc_thermal_profiles_show(struct device *dev,
for (cnt = 0; cnt < THM_PROFILE_MAX; cnt++) { for (cnt = 0; cnt < THM_PROFILE_MAX; cnt++) {
if (!cnt || (th_handle->profiles & cnt)) if (!cnt || (th_handle->profiles & cnt))
idx += snprintf(buffer + idx, PAGE_SIZE - idx, "%s ", idx += scnprintf(buffer + idx, PAGE_SIZE - idx, "%s ",
snc_thermal_profiles[cnt]); snc_thermal_profiles[cnt]);
} }
idx += snprintf(buffer + idx, PAGE_SIZE - idx, "\n"); idx += scnprintf(buffer + idx, PAGE_SIZE - idx, "\n");
return idx; return idx;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment