Commit 81156928 authored by Pavel Roskin's avatar Pavel Roskin Committed by Linus Torvalds

dell_rbu: use scnprintf() instead of less secure sprintf()

Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or
/sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an
oops.
Signed-off-by: default avatarPavel Roskin <proski@gnu.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 0d54ee1c
...@@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj, ...@@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj,
{ {
int size = 0; int size = 0;
if (!pos) if (!pos)
size = sprintf(buffer, "%s\n", image_type); size = scnprintf(buffer, count, "%s\n", image_type);
return size; return size;
} }
...@@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj, ...@@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj,
int size = 0; int size = 0;
if (!pos) { if (!pos) {
spin_lock(&rbu_data.lock); spin_lock(&rbu_data.lock);
size = sprintf(buffer, "%lu\n", rbu_data.packetsize); size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize);
spin_unlock(&rbu_data.lock); spin_unlock(&rbu_data.lock);
} }
return size; return size;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment