From: Takashi Iwai Date: Wed, 11 Mar 2020 07:49:16 +0000 (+0100) Subject: misc: mic: Use scnprintf() for avoiding potential buffer overflow X-Git-Tag: rel_imx_5.10.35_2.0.0-somdevices.0~2488^2~84 X-Git-Url: https://git.somdevices.com/?a=commitdiff_plain;h=d108b132ea39cdcd63a1d6b4460fc4c7d183c7e5;p=linux.git misc: mic: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20200311074916.8783-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/misc/mic/host/mic_x100.c b/drivers/misc/mic/host/mic_x100.c index a7743312da9c..d18cda966912 100644 --- a/drivers/misc/mic/host/mic_x100.c +++ b/drivers/misc/mic/host/mic_x100.c @@ -350,10 +350,10 @@ mic_x100_load_command_line(struct mic_device *mdev, const struct firmware *fw) if (!buf) return -ENOMEM; - len += snprintf(buf, CMDLINE_SIZE - len, + len += scnprintf(buf, CMDLINE_SIZE - len, " mem=%dM", boot_mem); if (mdev->cosm_dev->cmdline) - snprintf(buf + len, CMDLINE_SIZE - len, " %s", + scnprintf(buf + len, CMDLINE_SIZE - len, " %s", mdev->cosm_dev->cmdline); memcpy_toio(cmd_line_va, buf, strlen(buf) + 1); kfree(buf);