Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Verified Commit bc95714a authored by Michael Bestas's avatar Michael Bestas Committed by Ahmed Harhash
Browse files

msm: camera: Fix buffer overflow in cam_camera_cci_i2c_read_seq 

techpack/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.c:106:3: warning: 'sprintf' will always overflow; destination buffer has
size 4, but format string expands to at least 5 [-Wfortify-source]
                sprintf(cam_gyro_gain.s,"%c%c%c%c", d[0],d[1],d[2],d[3]);
                ^
techpack/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.c:111:3: warning: 'sprintf' will always overflow; destination buffer has
size 4, but format string expands to at least 5 [-Wfortify-source]
                sprintf(cam_gyro_gain.s,"%c%c%c%c", d[0],d[1],d[2],d[3]);
                ^

Change-Id: I16a3bffc124755b5e6cf3fa0cff63911b7e6ac7f
parent 2a91e9ef

techpack/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.c

+4 −2
Original line number Diff line number Diff line
@@ -104,12 +104,14 @@ int32_t cam_camera_cci_i2c_read_seq(struct cam_sensor_cci_client *cci_client, 
	if (num_byte == 7494){

		for (i = 0; i < 4; i++)

			d[i] = data[6980+i];

		sprintf(cam_gyro_gain.s,"%c%c%c%c", d[0],d[1],d[2],d[3]);

		snprintf(cam_gyro_gain.s, sizeof(cam_gyro_gain.s), "%c%c%c%c",

				d[0],d[1],d[2],d[3]);

		gyro_gain_X = cam_gyro_gain.f;//X gain



		for (i = 0; i < 4; i++)

			d[i] = data[6984+i];

		sprintf(cam_gyro_gain.s,"%c%c%c%c", d[0],d[1],d[2],d[3]);

		snprintf(cam_gyro_gain.s, sizeof(cam_gyro_gain.s), "%c%c%c%c",

				d[0],d[1],d[2],d[3]);

		gyro_gain_Y = cam_gyro_gain.f;//Y gain

	}