summaryrefslogtreecommitdiff
path: root/drivers/iio/industrialio-core.c
diff options
context:
space:
mode:
authorLars-Peter Clausen <lars@metafoo.de>2012-06-05 20:24:12 +0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-06-07 09:26:29 +0400
commit74dcd439bf8c16b01f9f5a9dffb2b171ed94e2e5 (patch)
tree9cc1f7185399fb3cf0f4cb193adbc377c7bed7e2 /drivers/iio/industrialio-core.c
parenta21e6bfeb40eddf365d3e7841b37f3708fa6b13f (diff)
downloadlinux-74dcd439bf8c16b01f9f5a9dffb2b171ed94e2e5.tar.xz
iio: iio_enum_available_read: Prevent possible buffer overflow
Use scnprint instead of snprintf, because snprintf returns the number of bytes that would have been written to the buffer if there was enough space, and as a result writing to buf[len-1] might cause a access beyond the buffers limits. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Acked-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/iio/industrialio-core.c')
-rw-r--r--drivers/iio/industrialio-core.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 56a3c0bc996c..cf9ecd0ae7c9 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -300,7 +300,7 @@ ssize_t iio_enum_available_read(struct iio_dev *indio_dev,
return 0;
for (i = 0; i < e->num_items; ++i)
- len += snprintf(buf + len, PAGE_SIZE - len, "%s ", e->items[i]);
+ len += scnprintf(buf + len, PAGE_SIZE - len, "%s ", e->items[i]);
/* replace last space with a newline */
buf[len - 1] = '\n';