Skip to content

Commit

Permalink
mmc: vub300: Use scnprintf() for avoiding potential buffer overflow
Browse files Browse the repository at this point in the history
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Ulf Hansson <[email protected]>
  • Loading branch information
tiwai authored and storulf committed Mar 24, 2020
1 parent 398b250 commit 6bbcf74
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/mmc/host/vub300.c
Original file line number Diff line number Diff line change
@@ -1363,7 +1363,7 @@ static void download_offload_pseudocode(struct vub300_mmc_host *vub300)
int retval;
for (n = 0; n < sdio_funcs; n++) {
struct sdio_func *sf = card->sdio_func[n];
l += snprintf(vub300->vub_name + l,
l += scnprintf(vub300->vub_name + l,
sizeof(vub300->vub_name) - l, "_%04X%04X",
sf->vendor, sf->device);
}

0 comments on commit 6bbcf74

Please sign in to comment.