[PATCH] efi/cper: Use scnprintf() for avoiding potential buffer overflow

[PATCH] efi/cper: Use scnprintf() for avoiding potential buffer overflow

[Takashi Iwai]

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 drivers/firmware/efi/cper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index b1af0de2e100..9d2512913d25 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -101,7 +101,7 @@ void cper_print_bits(const char *pfx, unsigned int bits,
 		if (!len)
 			len = snprintf(buf, sizeof(buf), "%s%s", pfx, str);
 		else
-			len += snprintf(buf+len, sizeof(buf)-len, ", %s", str);
+			len += scnprintf(buf+len, sizeof(buf)-len, ", %s", str);
 	}
 	if (len)
 		printk("%s\n", buf);
-- 
2.16.4

Re: [PATCH] efi/cper: Use scnprintf() for avoiding potential buffer overflow

[Takashi Iwai]

On Wed, 11 Mar 2020 08:21:45 +0100,
Takashi Iwai wrote:
> 
> Since snprintf() returns the would-be-output size instead of the
> actual output size, the succeeding calls may go beyond the given
> buffer limit.  Fix it by replacing with scnprintf().
> 
> Signed-off-by: Takashi Iwai <tiwai@suse.de>

A gentle reminder for this forgotten patch.
Let me know if any further changes are needed.


thanks,

Takashi

> ---
>  drivers/firmware/efi/cper.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
> index b1af0de2e100..9d2512913d25 100644
> --- a/drivers/firmware/efi/cper.c
> +++ b/drivers/firmware/efi/cper.c
> @@ -101,7 +101,7 @@ void cper_print_bits(const char *pfx, unsigned int bits,
>  		if (!len)
>  			len = snprintf(buf, sizeof(buf), "%s%s", pfx, str);
>  		else
> -			len += snprintf(buf+len, sizeof(buf)-len, ", %s", str);
> +			len += scnprintf(buf+len, sizeof(buf)-len, ", %s", str);
>  	}
>  	if (len)
>  		printk("%s\n", buf);
> -- 
> 2.16.4
> 

Re: [PATCH] efi/cper: Use scnprintf() for avoiding potential buffer overflow

[Ard Biesheuvel]

On Thu, 19 Mar 2020 at 17:00, Takashi Iwai <tiwai@suse.de> wrote:
>
> On Wed, 11 Mar 2020 08:21:45 +0100,
> Takashi Iwai wrote:
> >
> > Since snprintf() returns the would-be-output size instead of the
> > actual output size, the succeeding calls may go beyond the given
> > buffer limit.  Fix it by replacing with scnprintf().
> >
> > Signed-off-by: Takashi Iwai <tiwai@suse.de>
>
> A gentle reminder for this forgotten patch.
> Let me know if any further changes are needed.
>


Thanks Takashi, I'll queue this up.