tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

video: omapfb: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit. Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200311093230.24900-2-tiwai@suse.de

authored by

Takashi Iwai and committed by
Bartlomiej Zolnierkiewicz bf1b615a 0666a8d7

+7 -7
+7 -7
drivers/video/fbdev/omap/omapfb_main.c
··· 1247 1247 size = 0; 1248 1248 while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) { 1249 1249 omapfb_get_caps(fbdev, plane, &caps); 1250 - size += snprintf(&buf[size], PAGE_SIZE - size, 1250 + size += scnprintf(&buf[size], PAGE_SIZE - size, 1251 1251 "plane#%d %#010x %#010x %#010x\n", 1252 1252 plane, caps.ctrl, caps.plane_color, caps.wnd_color); 1253 1253 plane++; ··· 1268 1268 size = 0; 1269 1269 while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) { 1270 1270 omapfb_get_caps(fbdev, plane, &caps); 1271 - size += snprintf(&buf[size], PAGE_SIZE - size, 1271 + size += scnprintf(&buf[size], PAGE_SIZE - size, 1272 1272 "plane#%d:\n", plane); 1273 1273 for (i = 0; i < ARRAY_SIZE(ctrl_caps) && 1274 1274 size < PAGE_SIZE; i++) { 1275 1275 if (ctrl_caps[i].flag & caps.ctrl) 1276 - size += snprintf(&buf[size], PAGE_SIZE - size, 1276 + size += scnprintf(&buf[size], PAGE_SIZE - size, 1277 1277 " %s\n", ctrl_caps[i].name); 1278 1278 } 1279 - size += snprintf(&buf[size], PAGE_SIZE - size, 1279 + size += scnprintf(&buf[size], PAGE_SIZE - size, 1280 1280 " plane colors:\n"); 1281 1281 for (i = 0; i < ARRAY_SIZE(color_caps) && 1282 1282 size < PAGE_SIZE; i++) { 1283 1283 if (color_caps[i].flag & caps.plane_color) 1284 - size += snprintf(&buf[size], PAGE_SIZE - size, 1284 + size += scnprintf(&buf[size], PAGE_SIZE - size, 1285 1285 " %s\n", color_caps[i].name); 1286 1286 } 1287 - size += snprintf(&buf[size], PAGE_SIZE - size, 1287 + size += scnprintf(&buf[size], PAGE_SIZE - size, 1288 1288 " window colors:\n"); 1289 1289 for (i = 0; i < ARRAY_SIZE(color_caps) && 1290 1290 size < PAGE_SIZE; i++) { 1291 1291 if (color_caps[i].flag & caps.wnd_color) 1292 - size += snprintf(&buf[size], PAGE_SIZE - size, 1292 + size += scnprintf(&buf[size], PAGE_SIZE - size, 1293 1293 " %s\n", color_caps[i].name); 1294 1294 } 1295 1295