mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-05 10:04:12 +08:00
video: omapfb: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200311093230.24900-2-tiwai@suse.de
This commit is contained in:
parent
0666a8d7f6
commit
bf1b615ad9
@ -1247,7 +1247,7 @@ static ssize_t omapfb_show_caps_num(struct device *dev,
|
||||
size = 0;
|
||||
while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) {
|
||||
omapfb_get_caps(fbdev, plane, &caps);
|
||||
size += snprintf(&buf[size], PAGE_SIZE - size,
|
||||
size += scnprintf(&buf[size], PAGE_SIZE - size,
|
||||
"plane#%d %#010x %#010x %#010x\n",
|
||||
plane, caps.ctrl, caps.plane_color, caps.wnd_color);
|
||||
plane++;
|
||||
@ -1268,28 +1268,28 @@ static ssize_t omapfb_show_caps_text(struct device *dev,
|
||||
size = 0;
|
||||
while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) {
|
||||
omapfb_get_caps(fbdev, plane, &caps);
|
||||
size += snprintf(&buf[size], PAGE_SIZE - size,
|
||||
size += scnprintf(&buf[size], PAGE_SIZE - size,
|
||||
"plane#%d:\n", plane);
|
||||
for (i = 0; i < ARRAY_SIZE(ctrl_caps) &&
|
||||
size < PAGE_SIZE; i++) {
|
||||
if (ctrl_caps[i].flag & caps.ctrl)
|
||||
size += snprintf(&buf[size], PAGE_SIZE - size,
|
||||
size += scnprintf(&buf[size], PAGE_SIZE - size,
|
||||
" %s\n", ctrl_caps[i].name);
|
||||
}
|
||||
size += snprintf(&buf[size], PAGE_SIZE - size,
|
||||
size += scnprintf(&buf[size], PAGE_SIZE - size,
|
||||
" plane colors:\n");
|
||||
for (i = 0; i < ARRAY_SIZE(color_caps) &&
|
||||
size < PAGE_SIZE; i++) {
|
||||
if (color_caps[i].flag & caps.plane_color)
|
||||
size += snprintf(&buf[size], PAGE_SIZE - size,
|
||||
size += scnprintf(&buf[size], PAGE_SIZE - size,
|
||||
" %s\n", color_caps[i].name);
|
||||
}
|
||||
size += snprintf(&buf[size], PAGE_SIZE - size,
|
||||
size += scnprintf(&buf[size], PAGE_SIZE - size,
|
||||
" window colors:\n");
|
||||
for (i = 0; i < ARRAY_SIZE(color_caps) &&
|
||||
size < PAGE_SIZE; i++) {
|
||||
if (color_caps[i].flag & caps.wnd_color)
|
||||
size += snprintf(&buf[size], PAGE_SIZE - size,
|
||||
size += scnprintf(&buf[size], PAGE_SIZE - size,
|
||||
" %s\n", color_caps[i].name);
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user