diff options
| author | Takashi Iwai <[email protected]> | 2020-03-15 10:42:38 +0100 |
|---|---|---|
| committer | Martin K. Petersen <[email protected]> | 2020-03-17 13:36:11 -0400 |
| commit | 6f0cf4247442b24486f64df8b613deb294274b7c (patch) | |
| tree | 335a68df9837a5593fcfe8b32f368bc1408f3e29 | |
| parent | 473e554d656eb6d81df005a67f243b418554f5e5 (diff) | |
scsi: ipr: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the actual
output size, the succeeding calls may go beyond the given buffer limit.
Fix it by replacing with scnprintf().
Link: https://lore.kernel.org/r/[email protected]
Cc: "James E . J . Bottomley" <[email protected]>
Cc: "Martin K . Petersen" <[email protected]>
Cc: Brian King <[email protected]>
Cc: [email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
| -rw-r--r-- | drivers/scsi/ipr.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c index ae45cbe98ae2..155832d54efa 100644 --- a/drivers/scsi/ipr.c +++ b/drivers/scsi/ipr.c @@ -1299,9 +1299,9 @@ static char *__ipr_format_res_path(u8 *res_path, char *buffer, int len) char *p = buffer; *p = '\0'; - p += snprintf(p, buffer + len - p, "%02X", res_path[0]); + p += scnprintf(p, buffer + len - p, "%02X", res_path[0]); for (i = 1; res_path[i] != 0xff && ((i * 3) < len); i++) - p += snprintf(p, buffer + len - p, "-%02X", res_path[i]); + p += scnprintf(p, buffer + len - p, "-%02X", res_path[i]); return buffer; } @@ -1322,7 +1322,7 @@ static char *ipr_format_res_path(struct ipr_ioa_cfg *ioa_cfg, char *p = buffer; *p = '\0'; - p += snprintf(p, buffer + len - p, "%d/", ioa_cfg->host->host_no); + p += scnprintf(p, buffer + len - p, "%d/", ioa_cfg->host->host_no); __ipr_format_res_path(res_path, p, len - (buffer - p)); return buffer; } |