summaryrefslogtreecommitdiff
path: root/drivers/media
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2020-03-11 10:47:06 +0300
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>2020-03-20 18:27:42 +0300
commit4345e2e5c75895232a17e6783e6233beadc650c4 (patch)
tree195cdb7ccccb597417d5aa447bb3e2fbe3575d4e /drivers/media
parent4b508ed16acac15f4a762d5e10ed8d64a7ac3fb1 (diff)
downloadlinux-4345e2e5c75895232a17e6783e6233beadc650c4.tar.xz
media: rc: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/rc/nuvoton-cir.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index 5c2cd8d2d155..48a69bf23236 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -230,10 +230,10 @@ static ssize_t wakeup_data_show(struct device *dev,
for (i = 0; i < fifo_len; i++) {
duration = nvt_cir_wake_reg_read(nvt, CIR_WAKE_RD_FIFO_ONLY);
duration = (duration & BUF_LEN_MASK) * SAMPLE_PERIOD;
- buf_len += snprintf(buf + buf_len, PAGE_SIZE - buf_len,
+ buf_len += scnprintf(buf + buf_len, PAGE_SIZE - buf_len,
"%d ", duration);
}
- buf_len += snprintf(buf + buf_len, PAGE_SIZE - buf_len, "\n");
+ buf_len += scnprintf(buf + buf_len, PAGE_SIZE - buf_len, "\n");
spin_unlock_irqrestore(&nvt->lock, flags);