From: Dan Carpenter <dan.carpenter@oracle.com>
To: kernel-janitors@vger.kernel.org
Subject: [patch] virtio_console: use snprintf() for safety
Date: Fri, 08 May 2015 06:19:02 +0000 [thread overview]
Message-ID: <20150508061902.GA14769@mwanda> (raw)
My static checker complains that this sprintf() can overflow.
vdev->index is selected by ida_simple_get() in register_virtio_device()
so my reading of the code is that this overflow is theoretically
possible. The max value of "id" is configurable and I'm not sure what
typical values are.
Anyway, it's simple enough to make the buffer larger and I changed it to
snprintf() as well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 50754d20..8283989 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1389,7 +1389,7 @@ static void send_sigio_to_port(struct port *port)
static int add_port(struct ports_device *portdev, u32 id)
{
- char debugfs_name[16];
+ char debugfs_name[28];
struct port *port;
struct port_buffer *buf;
dev_t devt;
@@ -1492,8 +1492,8 @@ static int add_port(struct ports_device *portdev, u32 id)
* Finally, create the debugfs file that we can use to
* inspect a port's state at any time
*/
- sprintf(debugfs_name, "vport%up%u",
- port->portdev->vdev->index, id);
+ snprintf(debugfs_name, sizeof(debugfs_name), "vport%up%u",
+ port->portdev->vdev->index, id);
port->debugfs_file = debugfs_create_file(debugfs_name, 0444,
pdrvdata.debugfs_dir,
port,
next reply other threads:[~2015-05-08 6:19 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-08 6:19 Dan Carpenter [this message]
2015-05-08 6:43 ` [patch] virtio_console: use snprintf() for safety Amit Shah
2015-05-08 9:16 ` [patch v2] virtio_console: silence a static checker warning Dan Carpenter
2015-05-08 9:30 ` walter harms
2015-05-08 9:41 ` Amit Shah
2015-05-08 9:47 ` Dan Carpenter
2015-05-08 9:56 ` Amit Shah
2015-05-08 11:13 ` walter harms
2015-05-08 12:18 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150508061902.GA14769@mwanda \
--to=dan.carpenter@oracle.com \
--cc=kernel-janitors@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox