iio: iio_enum_available_read: Prevent possible buffer overflow
authorLars-Peter Clausen <lars@metafoo.de>
Tue, 5 Jun 2012 16:24:12 +0000 (18:24 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 7 Jun 2012 05:26:29 +0000 (14:26 +0900)
Use scnprint instead of snprintf, because snprintf returns the number of bytes
that would have been written to the buffer if there was enough space, and as a
result writing to buf[len-1] might cause a access beyond the buffers limits.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/iio/industrialio-core.c

index 56a3c0bc996c98f47bcd9633d24daecd8e4e239b..cf9ecd0ae7c9a8ed436bd6b6e22db4e31d1a813b 100644 (file)
@@ -300,7 +300,7 @@ ssize_t iio_enum_available_read(struct iio_dev *indio_dev,
                return 0;
 
        for (i = 0; i < e->num_items; ++i)
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s ", e->items[i]);
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s ", e->items[i]);
 
        /* replace last space with a newline */
        buf[len - 1] = '\n';