Commit caa47cc6 authored by Takashi Iwai's avatar Takashi Iwai Committed by Greg Kroah-Hartman
Browse files

tty: nozomi: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Also rewrite the code in a standard if-form instead of ugly
conditional operators.

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311092905.24362-1-tiwai@suse.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e39c0ffe

drivers/tty/nozomi.c

+33 −34
Original line number Diff line number Diff line
@@ -839,40 +839,39 @@ static char *interrupt2str(u16 interrupt) 
	static char buf[TMP_BUF_MAX];

	char *p = buf;



	interrupt & MDM_DL1 ? p += snprintf(p, TMP_BUF_MAX, "MDM_DL1 ") : NULL;

	interrupt & MDM_DL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"MDM_DL2 ") : NULL;



	interrupt & MDM_UL1 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"MDM_UL1 ") : NULL;

	interrupt & MDM_UL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"MDM_UL2 ") : NULL;



	interrupt & DIAG_DL1 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"DIAG_DL1 ") : NULL;

	interrupt & DIAG_DL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"DIAG_DL2 ") : NULL;



	interrupt & DIAG_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"DIAG_UL ") : NULL;



	interrupt & APP1_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"APP1_DL ") : NULL;

	interrupt & APP2_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"APP2_DL ") : NULL;



	interrupt & APP1_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"APP1_UL ") : NULL;

	interrupt & APP2_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"APP2_UL ") : NULL;



	interrupt & CTRL_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"CTRL_DL ") : NULL;

	interrupt & CTRL_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"CTRL_UL ") : NULL;



	interrupt & RESET ? p += snprintf(p, TMP_BUF_MAX - (p - buf),

					"RESET ") : NULL;

	if (interrupt & MDM_DL1)

		p += scnprintf(p, TMP_BUF_MAX, "MDM_DL1 ");

	if (interrupt & MDM_DL2)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_DL2 ");

	if (interrupt & MDM_UL1)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_UL1 ");

	if (interrupt & MDM_UL2)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_UL2 ");

	if (interrupt & DIAG_DL1)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_DL1 ");

	if (interrupt & DIAG_DL2)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_DL2 ");



	if (interrupt & DIAG_UL)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_UL ");



	if (interrupt & APP1_DL)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP1_DL ");

	if (interrupt & APP2_DL)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP2_DL ");



	if (interrupt & APP1_UL)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP1_UL ");

	if (interrupt & APP2_UL)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP2_UL ");



	if (interrupt & CTRL_DL)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "CTRL_DL ");

	if (interrupt & CTRL_UL)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "CTRL_UL ");



	if (interrupt & RESET)

		p += scnprintf(p, TMP_BUF_MAX - (p - buf), "RESET ");



	return buf;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE