Commit 6d3fbe91 authored by Takashi Iwai's avatar Takashi Iwai Committed by Dominik Brodowski
Browse files

pcmcia: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
parent 7c8c5673

drivers/pcmcia/rsrc_nonstatic.c

+3 −3
Original line number Diff line number Diff line
@@ -1076,7 +1076,7 @@ static ssize_t show_io_db(struct device *dev, 
	for (p = data->io_db.next; p != &data->io_db; p = p->next) {

		if (ret > (PAGE_SIZE - 10))

			continue;

		ret += snprintf(&buf[ret], (PAGE_SIZE - ret - 1),

		ret += scnprintf(&buf[ret], (PAGE_SIZE - ret - 1),

				"0x%08lx - 0x%08lx\n",

				((unsigned long) p->base),

				((unsigned long) p->base + p->num - 1));
@@ -1133,7 +1133,7 @@ static ssize_t show_mem_db(struct device *dev, 
	     p = p->next) {

		if (ret > (PAGE_SIZE - 10))

			continue;

		ret += snprintf(&buf[ret], (PAGE_SIZE - ret - 1),

		ret += scnprintf(&buf[ret], (PAGE_SIZE - ret - 1),

				"0x%08lx - 0x%08lx\n",

				((unsigned long) p->base),

				((unsigned long) p->base + p->num - 1));
@@ -1142,7 +1142,7 @@ static ssize_t show_mem_db(struct device *dev, 
	for (p = data->mem_db.next; p != &data->mem_db; p = p->next) {

		if (ret > (PAGE_SIZE - 10))

			continue;

		ret += snprintf(&buf[ret], (PAGE_SIZE - ret - 1),

		ret += scnprintf(&buf[ret], (PAGE_SIZE - ret - 1),

				"0x%08lx - 0x%08lx\n",

				((unsigned long) p->base),

				((unsigned long) p->base + p->num - 1));

drivers/pcmcia/yenta_socket.c

+5 −5
Original line number Diff line number Diff line
@@ -180,12 +180,12 @@ static ssize_t show_yenta_registers(struct device *yentadev, struct device_attri 
	for (i = 0; i < 0x24; i += 4) {

		unsigned val;

		if (!(i & 15))

			offset += snprintf(buf + offset, PAGE_SIZE - offset, "\n%02x:", i);

			offset += scnprintf(buf + offset, PAGE_SIZE - offset, "\n%02x:", i);

		val = cb_readl(socket, i);

		offset += snprintf(buf + offset, PAGE_SIZE - offset, " %08x", val);

		offset += scnprintf(buf + offset, PAGE_SIZE - offset, " %08x", val);

	}



	offset += snprintf(buf + offset, PAGE_SIZE - offset, "\n\nExCA registers:");

	offset += scnprintf(buf + offset, PAGE_SIZE - offset, "\n\nExCA registers:");

	for (i = 0; i < 0x45; i++) {

		unsigned char val;

		if (!(i & 7)) {
@@ -193,10 +193,10 @@ static ssize_t show_yenta_registers(struct device *yentadev, struct device_attri 
				memcpy(buf + offset, " -", 2);

				offset += 2;

			} else

				offset += snprintf(buf + offset, PAGE_SIZE - offset, "\n%02x:", i);

				offset += scnprintf(buf + offset, PAGE_SIZE - offset, "\n%02x:", i);

		}

		val = exca_readb(socket, i);

		offset += snprintf(buf + offset, PAGE_SIZE - offset, " %02x", val);

		offset += scnprintf(buf + offset, PAGE_SIZE - offset, " %02x", val);

	}

	buf[offset++] = '\n';

	return offset;

CRA Git | Maintained and supported by SUSTech CRA and CCSE