Skip to content

Commit dbdd24e

Browse files
committed
edd: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Takashi Iwai <[email protected]>
1 parent ca707b3 commit dbdd24e

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

drivers/firmware/edd.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -341,7 +341,7 @@ edd_show_legacy_max_cylinder(struct edd_device *edev, char *buf)
341341
if (!info || !buf)
342342
return -EINVAL;
343343

344-
p += snprintf(p, left, "%u\n", info->legacy_max_cylinder);
344+
p += scnprintf(p, left, "%u\n", info->legacy_max_cylinder);
345345
return (p - buf);
346346
}
347347

@@ -356,7 +356,7 @@ edd_show_legacy_max_head(struct edd_device *edev, char *buf)
356356
if (!info || !buf)
357357
return -EINVAL;
358358

359-
p += snprintf(p, left, "%u\n", info->legacy_max_head);
359+
p += scnprintf(p, left, "%u\n", info->legacy_max_head);
360360
return (p - buf);
361361
}
362362

@@ -371,7 +371,7 @@ edd_show_legacy_sectors_per_track(struct edd_device *edev, char *buf)
371371
if (!info || !buf)
372372
return -EINVAL;
373373

374-
p += snprintf(p, left, "%u\n", info->legacy_sectors_per_track);
374+
p += scnprintf(p, left, "%u\n", info->legacy_sectors_per_track);
375375
return (p - buf);
376376
}
377377

0 commit comments

Comments
 (0)