From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753501AbbFDNfE (ORCPT ); Thu, 4 Jun 2015 09:35:04 -0400 Received: from mail-pa0-f48.google.com ([209.85.220.48]:33201 "EHLO mail-pa0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752617AbbFDNfC (ORCPT ); Thu, 4 Jun 2015 09:35:02 -0400 From: Sudip Mukherjee To: Thomas Petazzoni , =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= , Greg Kroah-Hartman Cc: devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, Sudip Mukherjee Subject: [PATCH v2] staging: fbtft: fix out of bound access Date: Thu, 4 Jun 2015 19:04:52 +0530 Message-Id: <1433424892-23333-1-git-send-email-sudipm.mukherjee@gmail.com> X-Mailer: git-send-email 1.8.1.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org str was 16 bytes but was mentioned as 128 in snprintf. again msg is 128 bytes but not sufficient to hold the complete debug message of register values. Now removed the use of str, msg and print the register values from the loop. Signed-off-by: Sudip Mukherjee --- v2: removed the use of msg and str. drivers/staging/fbtft/fbtft-core.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c index ce64521..c1502c3 100644 --- a/drivers/staging/fbtft/fbtft-core.c +++ b/drivers/staging/fbtft/fbtft-core.c @@ -1067,8 +1067,6 @@ static int fbtft_init_display_dt(struct fbtft_par *par) const __be32 *p; u32 val; int buf[64], i, j; - char msg[128]; - char str[16]; fbtft_par_dbg(DEBUG_INIT_DISPLAY, par, "%s()\n", __func__); @@ -1094,13 +1092,11 @@ static int fbtft_init_display_dt(struct fbtft_par *par) p = of_prop_next_u32(prop, p, &val); } /* make debug message */ - msg[0] = '\0'; - for (j = 0; j < i; j++) { - snprintf(str, 128, " %02X", buf[j]); - strcat(msg, str); - } fbtft_par_dbg(DEBUG_INIT_DISPLAY, par, "init: write_register:%s\n", msg); + for (j = 0; j < i; j++) + fbtft_par_dbg(DEBUG_INIT_DISPLAY, par, + "buf[%d] = %02X\n", j, buf[j]); par->fbtftops.write_register(par, i, buf[0], buf[1], buf[2], buf[3], -- 1.8.1.2