Messages in this thread Patch in this message | | | From | Takashi Iwai <> | Subject | [PATCH] tty: nozomi: Use scnprintf() for avoiding potential buffer overflow | Date | Wed, 11 Mar 2020 10:29:05 +0100 |
| |
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf().
Also rewrite the code in a standard if-form instead of ugly conditional operators.
Signed-off-by: Takashi Iwai <tiwai@suse.de> --- drivers/tty/nozomi.c | 67 ++++++++++++++++++++++++++-------------------------- 1 file changed, 33 insertions(+), 34 deletions(-)
diff --git a/drivers/tty/nozomi.c b/drivers/tty/nozomi.c index ed99948f3b7f..3af193343f60 100644 --- a/drivers/tty/nozomi.c +++ b/drivers/tty/nozomi.c @@ -839,40 +839,39 @@ static char *interrupt2str(u16 interrupt) static char buf[TMP_BUF_MAX]; char *p = buf; - interrupt & MDM_DL1 ? p += snprintf(p, TMP_BUF_MAX, "MDM_DL1 ") : NULL; - interrupt & MDM_DL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "MDM_DL2 ") : NULL; - - interrupt & MDM_UL1 ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "MDM_UL1 ") : NULL; - interrupt & MDM_UL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "MDM_UL2 ") : NULL; - - interrupt & DIAG_DL1 ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "DIAG_DL1 ") : NULL; - interrupt & DIAG_DL2 ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "DIAG_DL2 ") : NULL; - - interrupt & DIAG_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "DIAG_UL ") : NULL; - - interrupt & APP1_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "APP1_DL ") : NULL; - interrupt & APP2_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "APP2_DL ") : NULL; - - interrupt & APP1_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "APP1_UL ") : NULL; - interrupt & APP2_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "APP2_UL ") : NULL; - - interrupt & CTRL_DL ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "CTRL_DL ") : NULL; - interrupt & CTRL_UL ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "CTRL_UL ") : NULL; - - interrupt & RESET ? p += snprintf(p, TMP_BUF_MAX - (p - buf), - "RESET ") : NULL; + if (interrupt & MDM_DL1) + p += scnprintf(p, TMP_BUF_MAX, "MDM_DL1 "); + if (interrupt & MDM_DL2) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_DL2 "); + if (interrupt & MDM_UL1) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_UL1 "); + if (interrupt & MDM_UL2) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "MDM_UL2 "); + if (interrupt & DIAG_DL1) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_DL1 "); + if (interrupt & DIAG_DL2) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_DL2 "); + + if (interrupt & DIAG_UL) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "DIAG_UL "); + + if (interrupt & APP1_DL) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP1_DL "); + if (interrupt & APP2_DL) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP2_DL "); + + if (interrupt & APP1_UL) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP1_UL "); + if (interrupt & APP2_UL) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "APP2_UL "); + + if (interrupt & CTRL_DL) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "CTRL_DL "); + if (interrupt & CTRL_UL) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "CTRL_UL "); + + if (interrupt & RESET) + p += scnprintf(p, TMP_BUF_MAX - (p - buf), "RESET "); return buf; } -- 2.16.4
| |