diff options
| author | Rasmus Villemoes <[email protected]> | 2015-02-12 15:01:39 -0800 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2015-02-12 18:54:13 -0800 |
| commit | 2aa2f9e21e4eb25c720b2e7d80f8929638f6ad73 (patch) | |
| tree | 727a89ea34898d8c0da28c87a1259d079ddcab6a | |
| parent | ffbfed03b4bdd229b99c2611f5ace1fbc912caaa (diff) | |
lib/vsprintf.c: improve sanity check in vsnprintf()
On 64 bit, size may very well be huge even if bit 31 happens to be 0.
Somehow it doesn't feel right that one can pass a 5 GiB buffer but not a
3 GiB one. So cap at INT_MAX as was probably the intention all along.
This is also the made-up value passed by sprintf and vsprintf.
Signed-off-by: Rasmus Villemoes <[email protected]>
Cc: Jiri Kosina <[email protected]>
Cc: Randy Dunlap <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
| -rw-r--r-- | lib/vsprintf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 98ad170b10e0..cf12ba86205c 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -1727,7 +1727,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) /* Reject out-of-range values early. Large positive sizes are used for unknown buffer sizes. */ - if (WARN_ON_ONCE((int) size < 0)) + if (WARN_ON_ONCE(size > INT_MAX)) return 0; str = buf; |