* [patch] enic: change sprintf() to snprintf()
@ 2013-01-18 7:46 Dan Carpenter
2013-01-18 19:35 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2013-01-18 7:46 UTC (permalink / raw)
To: Christian Benvenuti
Cc: Roopa Prabhu, Neel Patel, Nishank Trivedi, netdev,
kernel-janitors
These are copying data into 16 char arrays. They all specify that the
first string can't be more than 11 characters but once you add on the
"-rx-" and the NUL character there isn't space for the %d.
The first string is probably never going to be 11 characters, but if it
is then let's truncate the string instead of corrupting memory.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index ebccebf..ec1a233 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1490,7 +1490,8 @@ static int enic_request_intr(struct enic *enic)
for (i = 0; i < enic->rq_count; i++) {
intr = enic_msix_rq_intr(enic, i);
- sprintf(enic->msix[intr].devname,
+ snprintf(enic->msix[intr].devname,
+ sizeof(enic->msix[intr].devname),
"%.11s-rx-%d", netdev->name, i);
enic->msix[intr].isr = enic_isr_msix_rq;
enic->msix[intr].devid = &enic->napi[i];
@@ -1498,20 +1499,23 @@ static int enic_request_intr(struct enic *enic)
for (i = 0; i < enic->wq_count; i++) {
intr = enic_msix_wq_intr(enic, i);
- sprintf(enic->msix[intr].devname,
+ snprintf(enic->msix[intr].devname,
+ sizeof(enic->msix[intr].devname),
"%.11s-tx-%d", netdev->name, i);
enic->msix[intr].isr = enic_isr_msix_wq;
enic->msix[intr].devid = enic;
}
intr = enic_msix_err_intr(enic);
- sprintf(enic->msix[intr].devname,
+ snprintf(enic->msix[intr].devname,
+ sizeof(enic->msix[intr].devname),
"%.11s-err", netdev->name);
enic->msix[intr].isr = enic_isr_msix_err;
enic->msix[intr].devid = enic;
intr = enic_msix_notify_intr(enic);
- sprintf(enic->msix[intr].devname,
+ snprintf(enic->msix[intr].devname,
+ sizeof(enic->msix[intr].devname),
"%.11s-notify", netdev->name);
enic->msix[intr].isr = enic_isr_msix_notify;
enic->msix[intr].devid = enic;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] enic: change sprintf() to snprintf()
2013-01-18 7:46 [patch] enic: change sprintf() to snprintf() Dan Carpenter
@ 2013-01-18 19:35 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2013-01-18 19:35 UTC (permalink / raw)
To: dan.carpenter
Cc: benve, roprabhu, neepatel, nistrive, netdev, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 18 Jan 2013 10:46:18 +0300
> These are copying data into 16 char arrays. They all specify that the
> first string can't be more than 11 characters but once you add on the
> "-rx-" and the NUL character there isn't space for the %d.
>
> The first string is probably never going to be 11 characters, but if it
> is then let's truncate the string instead of corrupting memory.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied to net-next, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-01-18 19:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-01-18 7:46 [patch] enic: change sprintf() to snprintf() Dan Carpenter
2013-01-18 19:35 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).