Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81156928 authored by Pavel Roskin's avatar Pavel Roskin Committed by Linus Torvalds
Browse files

dell_rbu: use scnprintf() instead of less secure sprintf() 



Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or
/sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an
oops.

Signed-off-by: default avatarPavel Roskin <proski@gnu.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 0d54ee1c

drivers/firmware/dell_rbu.c

+2 −2
Original line number Diff line number Diff line
@@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj, 
{

	int size = 0;

	if (!pos)

		size = sprintf(buffer, "%s\n", image_type);

		size = scnprintf(buffer, count, "%s\n", image_type);

	return size;

}
@@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj, 
	int size = 0;

	if (!pos) {

		spin_lock(&rbu_data.lock);

		size = sprintf(buffer, "%lu\n", rbu_data.packetsize);

		size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize);

		spin_unlock(&rbu_data.lock);

	}

	return size;