[PATCH] power: twl4030: Use scnprintf() for avoiding potential buffer overflow

[PATCH] power: twl4030: Use scnprintf() for avoiding potential buffer overflow

[Takashi Iwai]

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 drivers/power/supply/twl4030_charger.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
index 648ab80288c9..1bc49b2e12e8 100644
--- a/drivers/power/supply/twl4030_charger.c
+++ b/drivers/power/supply/twl4030_charger.c
@@ -726,10 +726,10 @@ twl4030_bci_mode_show(struct device *dev,
 
 	for (i = 0; i < ARRAY_SIZE(modes); i++)
 		if (mode == i)
-			len += snprintf(buf+len, PAGE_SIZE-len,
+			len += scnprintf(buf+len, PAGE_SIZE-len,
 					"[%s] ", modes[i]);
 		else
-			len += snprintf(buf+len, PAGE_SIZE-len,
+			len += scnprintf(buf+len, PAGE_SIZE-len,
 					"%s ", modes[i]);
 	buf[len-1] = '\n';
 	return len;
-- 
2.16.4

Re: [PATCH] power: twl4030: Use scnprintf() for avoiding potential buffer overflow

[Sebastian Reichel]

[-- Attachment #1: Type: text/plain, Size: 1157 bytes --]

Hi,

On Wed, Mar 11, 2020 at 10:08:18AM +0100, Takashi Iwai wrote:
> Since snprintf() returns the would-be-output size instead of the
> actual output size, the succeeding calls may go beyond the given
> buffer limit.  Fix it by replacing with scnprintf().
> 
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> ---

Thanks, queued.

-- Sebastian

>  drivers/power/supply/twl4030_charger.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
> index 648ab80288c9..1bc49b2e12e8 100644
> --- a/drivers/power/supply/twl4030_charger.c
> +++ b/drivers/power/supply/twl4030_charger.c
> @@ -726,10 +726,10 @@ twl4030_bci_mode_show(struct device *dev,
>  
>  	for (i = 0; i < ARRAY_SIZE(modes); i++)
>  		if (mode == i)
> -			len += snprintf(buf+len, PAGE_SIZE-len,
> +			len += scnprintf(buf+len, PAGE_SIZE-len,
>  					"[%s] ", modes[i]);
>  		else
> -			len += snprintf(buf+len, PAGE_SIZE-len,
> +			len += scnprintf(buf+len, PAGE_SIZE-len,
>  					"%s ", modes[i]);
>  	buf[len-1] = '\n';
>  	return len;
> -- 
> 2.16.4
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]