iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iio: core: Use scnprintf() for avoiding potential buffer overflow

Browse Source 
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
This commit is contained in:
Takashi Iwai 2020-03-11 08:43:24 +01:00 committed by Jonathan Cameron
parent 2dbbe4d513
commit 35a4eeb055
1 changed files with 17 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/iio/industrialio-core.c
View File

@ -566,46 +566,46 @@ static ssize_t __iio_format_value(char *buf, size_t len, unsigned int type,
switch (type) { switch (type) {
case IIO_VAL_INT: case IIO_VAL_INT:
return snprintf(buf, len, "%d", vals[0]); return scnprintf(buf, len, "%d", vals[0]);
case IIO_VAL_INT_PLUS_MICRO_DB: case IIO_VAL_INT_PLUS_MICRO_DB:
scale_db = true; scale_db = true;
/* fall through */ /* fall through */
case IIO_VAL_INT_PLUS_MICRO: case IIO_VAL_INT_PLUS_MICRO:
if (vals[1] < 0) if (vals[1] < 0)
return snprintf(buf, len, "-%d.%06u%s", abs(vals[0]), return scnprintf(buf, len, "-%d.%06u%s", abs(vals[0]),
-vals[1], scale_db ? " dB" : ""); -vals[1], scale_db ? " dB" : "");
else else
return snprintf(buf, len, "%d.%06u%s", vals[0], vals[1], return scnprintf(buf, len, "%d.%06u%s", vals[0], vals[1],
scale_db ? " dB" : ""); scale_db ? " dB" : "");
case IIO_VAL_INT_PLUS_NANO: case IIO_VAL_INT_PLUS_NANO:
if (vals[1] < 0) if (vals[1] < 0)
return snprintf(buf, len, "-%d.%09u", abs(vals[0]), return scnprintf(buf, len, "-%d.%09u", abs(vals[0]),
-vals[1]); -vals[1]);
else else
return snprintf(buf, len, "%d.%09u", vals[0], vals[1]); return scnprintf(buf, len, "%d.%09u", vals[0], vals[1]);
case IIO_VAL_FRACTIONAL: case IIO_VAL_FRACTIONAL:
tmp = div_s64((s64)vals[0] * 1000000000LL, vals[1]); tmp = div_s64((s64)vals[0] * 1000000000LL, vals[1]);
tmp1 = vals[1]; tmp1 = vals[1];
tmp0 = (int)div_s64_rem(tmp, 1000000000, &tmp1); tmp0 = (int)div_s64_rem(tmp, 1000000000, &tmp1);
return snprintf(buf, len, "%d.%09u", tmp0, abs(tmp1)); return scnprintf(buf, len, "%d.%09u", tmp0, abs(tmp1));
case IIO_VAL_FRACTIONAL_LOG2: case IIO_VAL_FRACTIONAL_LOG2:
tmp = shift_right((s64)vals[0] * 1000000000LL, vals[1]); tmp = shift_right((s64)vals[0] * 1000000000LL, vals[1]);
tmp0 = (int)div_s64_rem(tmp, 1000000000LL, &tmp1); tmp0 = (int)div_s64_rem(tmp, 1000000000LL, &tmp1);
return snprintf(buf, len, "%d.%09u", tmp0, abs(tmp1)); return scnprintf(buf, len, "%d.%09u", tmp0, abs(tmp1));
case IIO_VAL_INT_MULTIPLE: case IIO_VAL_INT_MULTIPLE:
{ {
int i; int i;
int l = 0; int l = 0;
for (i = 0; i < size; ++i) { for (i = 0; i < size; ++i) {
l += snprintf(&buf[l], len - l, "%d ", vals[i]); l += scnprintf(&buf[l], len - l, "%d ", vals[i]);
if (l >= len) if (l >= len)
break; break;
} }
return l; return l;
} }
case IIO_VAL_CHAR: case IIO_VAL_CHAR:
return snprintf(buf, len, "%c", (char)vals[0]); return scnprintf(buf, len, "%c", (char)vals[0]);
default: default:
return 0; return 0;
} }
@ -676,10 +676,10 @@ static ssize_t iio_format_avail_list(char *buf, const int *vals,
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE)
return -EFBIG; return -EFBIG;
if (i < length - 1) if (i < length - 1)
len += snprintf(buf + len, PAGE_SIZE - len, len += scnprintf(buf + len, PAGE_SIZE - len,
" "); " ");
else else
len += snprintf(buf + len, PAGE_SIZE - len, len += scnprintf(buf + len, PAGE_SIZE - len,
"\n"); "\n");
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE)
return -EFBIG; return -EFBIG;
@ -692,10 +692,10 @@ static ssize_t iio_format_avail_list(char *buf, const int *vals,
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE)
return -EFBIG; return -EFBIG;
if (i < length / 2 - 1) if (i < length / 2 - 1)
len += snprintf(buf + len, PAGE_SIZE - len, len += scnprintf(buf + len, PAGE_SIZE - len,
" "); " ");
else else
len += snprintf(buf + len, PAGE_SIZE - len, len += scnprintf(buf + len, PAGE_SIZE - len,
"\n"); "\n");
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE)
return -EFBIG; return -EFBIG;
@ -719,10 +719,10 @@ static ssize_t iio_format_avail_range(char *buf, const int *vals, int type)
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE)
return -EFBIG; return -EFBIG;
if (i < 2) if (i < 2)
len += snprintf(buf + len, PAGE_SIZE - len, len += scnprintf(buf + len, PAGE_SIZE - len,
" "); " ");
else else
len += snprintf(buf + len, PAGE_SIZE - len, len += scnprintf(buf + len, PAGE_SIZE - len,
"]\n"); "]\n");
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE)
return -EFBIG; return -EFBIG;
@ -735,10 +735,10 @@ static ssize_t iio_format_avail_range(char *buf, const int *vals, int type)
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE)
return -EFBIG; return -EFBIG;
if (i < 2) if (i < 2)
len += snprintf(buf + len, PAGE_SIZE - len, len += scnprintf(buf + len, PAGE_SIZE - len,
" "); " ");
else else
len += snprintf(buf + len, PAGE_SIZE - len, len += scnprintf(buf + len, PAGE_SIZE - len,
"]\n"); "]\n");
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE)
return -EFBIG; return -EFBIG;