diff options
| author | Takashi Iwai <tiwai@suse.de> | 2020-03-11 09:04:39 +0100 |
|---|---|---|
| committer | Ulf Hansson <ulf.hansson@linaro.org> | 2020-03-24 14:39:52 +0100 |
| commit | 6bbcf74dd929d0b7d8588ffdd38803bb455873f1 (patch) | |
| tree | f6bd006df2656035d34d8de30f9d8087e2de9663 /drivers/mmc/host/vub300.c | |
| parent | 398b25003d3a2747109015f3fe719bbee94cb82b (diff) | |
mmc: vub300: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit. Fix it by replacing with scnprintf().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311080439.13928-1-tiwai@suse.de
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Diffstat (limited to 'drivers/mmc/host/vub300.c')
| -rw-r--r-- | drivers/mmc/host/vub300.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c index a5a90d133f1f..739cf63ef6e2 100644 --- a/drivers/mmc/host/vub300.c +++ b/drivers/mmc/host/vub300.c @@ -1363,7 +1363,7 @@ static void download_offload_pseudocode(struct vub300_mmc_host *vub300) int retval; for (n = 0; n < sdio_funcs; n++) { struct sdio_func *sf = card->sdio_func[n]; - l += snprintf(vub300->vub_name + l, + l += scnprintf(vub300->vub_name + l, sizeof(vub300->vub_name) - l, "_%04X%04X", sf->vendor, sf->device); } |