From d108b132ea39cdcd63a1d6b4460fc4c7d183c7e5 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 11 Mar 2020 08:49:16 +0100 Subject: misc: mic: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20200311074916.8783-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mic/host/mic_x100.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/misc/mic') diff --git a/drivers/misc/mic/host/mic_x100.c b/drivers/misc/mic/host/mic_x100.c index a7743312da9c..d18cda966912 100644 --- a/drivers/misc/mic/host/mic_x100.c +++ b/drivers/misc/mic/host/mic_x100.c @@ -350,10 +350,10 @@ mic_x100_load_command_line(struct mic_device *mdev, const struct firmware *fw) if (!buf) return -ENOMEM; - len += snprintf(buf, CMDLINE_SIZE - len, + len += scnprintf(buf, CMDLINE_SIZE - len, " mem=%dM", boot_mem); if (mdev->cosm_dev->cmdline) - snprintf(buf + len, CMDLINE_SIZE - len, " %s", + scnprintf(buf + len, CMDLINE_SIZE - len, " %s", mdev->cosm_dev->cmdline); memcpy_toio(cmd_line_va, buf, strlen(buf) + 1); kfree(buf); -- cgit v1.2.3