block: DAC960: shut up format-overflow warning (33027c2b) · Commits · 戴 / test

gcc-7 points out that a large controller number would overflow the string length for the procfs name and the firmware version string: drivers/block/DAC960.c: In function 'DAC960_Probe': drivers/block/DAC960.c:6591:38: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=] drivers/block/DAC960.c: In function 'DAC960_V1_ReadControllerConfiguration': drivers/block/DAC960.c:1681:40: error: '%02d' directive writing between 2 and 3 bytes into a region of size between 2 and 5 [-Werror=format-overflow=] drivers/block/DAC960.c:1681:40: note: directive argument in the range [0, 255] drivers/block/DAC960.c:1681:3: note: 'sprintf' output between 10 and 14 bytes into a destination of size 12 Both of these seem appropriately sized, and using snprintf() instead of sprintf() improves this by ensuring that even incorrect data won't cause undefined behavior here. Signed-off-by:

Arnd Bergmann <arnd@arndb.de> Signed-off-by:

Jens Axboe <axboe@kernel.dk>

drivers/block/DAC960.c

+8 −4

Original line number	Diff line number	Diff line
		@@ -1678,9 +1678,12 @@ static bool DAC960_V1_ReadControllerConfiguration(DAC960_Controller_T
		Enquiry2->FirmwareID.FirmwareType = '0';
		Enquiry2->FirmwareID.TurnID = 0;
		}
		sprintf(Controller->FirmwareVersion, "%d.%02d-%c-%02d",
		Enquiry2->FirmwareID.MajorVersion, Enquiry2->FirmwareID.MinorVersion,
		Enquiry2->FirmwareID.FirmwareType, Enquiry2->FirmwareID.TurnID);
		snprintf(Controller->FirmwareVersion, sizeof(Controller->FirmwareVersion),
		"%d.%02d-%c-%02d",
		Enquiry2->FirmwareID.MajorVersion,
		Enquiry2->FirmwareID.MinorVersion,
		Enquiry2->FirmwareID.FirmwareType,
		Enquiry2->FirmwareID.TurnID);
		if (!((Controller->FirmwareVersion[0] == '5' &&
		strcmp(Controller->FirmwareVersion, "5.06") >= 0) \|\|
		(Controller->FirmwareVersion[0] == '4' &&
		@@ -6588,7 +6591,8 @@ static void DAC960_CreateProcEntries(DAC960_Controller_T *Controller)
		&dac960_proc_fops);
		}

		sprintf(Controller->ControllerName, "c%d", Controller->ControllerNumber);
		snprintf(Controller->ControllerName, sizeof(Controller->ControllerName),
		"c%d", Controller->ControllerNumber);
		ControllerProcEntry = proc_mkdir(Controller->ControllerName,
		DAC960_ProcDirectoryEntry);
		proc_create_data("initial_status", 0, ControllerProcEntry, &dac960_initial_status_proc_fops, Controller);

Admin message