iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ASoC: SOF: debug: Fix potential buffer overflow by snprintf()

Browse Source 
snprintf() returns the would-be-filled size when the string overflows
the given buffer size, hence using this value may result in the buffer
overflow (although it's unrealistic).

This patch replaces with a safer version, scnprintf() for papering
over such a potential issue.

Fixes: 5b10b62989 ("ASoC: SOF: Add `memory_info` file to debugfs")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20220801165420.25978-3-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Takashi Iwai 2022-08-01 18:54:19 +02:00 committed by Mark Brown
parent ca3b7b9dc9
commit 1eb123ce98
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sound/soc/sof/debug.c
View File

@ -252,7 +252,7 @@ static int memory_info_update(struct snd_sof_dev *sdev, char *buf, size_t buff_s
} }
for (i = 0, len = 0; i < reply->num_elems; i++) { for (i = 0, len = 0; i < reply->num_elems; i++) {
ret = snprintf(buf + len, buff_size - len, "zone %d.%d used %#8x free %#8x\n", ret = scnprintf(buf + len, buff_size - len, "zone %d.%d used %#8x free %#8x\n",
reply->elems[i].zone, reply->elems[i].id, reply->elems[i].zone, reply->elems[i].id,
reply->elems[i].used, reply->elems[i].free); reply->elems[i].used, reply->elems[i].free);
if (ret < 0) if (ret < 0)