From 06b522d6de9d7b429f368210c93d5414ead3586b Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 11 Mar 2020 10:32:30 +0100 Subject: [PATCH] video: uvesafb: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai Signed-off-by: Bartlomiej Zolnierkiewicz Link: https://patchwork.freedesktop.org/patch/msgid/20200311093230.24900-4-tiwai@suse.de --- drivers/video/fbdev/uvesafb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c index 53d08d1b56f5..1b385cf76110 100644 --- a/drivers/video/fbdev/uvesafb.c +++ b/drivers/video/fbdev/uvesafb.c @@ -1560,7 +1560,7 @@ static ssize_t uvesafb_show_vbe_modes(struct device *dev, int ret = 0, i; for (i = 0; i < par->vbe_modes_cnt && ret < PAGE_SIZE; i++) { - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "%dx%d-%d, 0x%.4x\n", par->vbe_modes[i].x_res, par->vbe_modes[i].y_res, par->vbe_modes[i].depth, par->vbe_modes[i].mode_id); -- 2.39.5