Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8970e978 authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan
Browse files

msm_bam_rmnet: Fix potential memory corruption 



Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
parent 1bcdd163

drivers/net/ethernet/msm/msm_rmnet_bam.c

+5 −4
Original line number Diff line number Diff line
@@ -118,7 +118,8 @@ static ssize_t timeout_suspend_show(struct device *d, 
				    struct device_attribute *attr,

				    char *buf)

{

	return sprintf(buf, "%lu\n", (unsigned long) timeout_suspend_us);

	return snprintf(buf, PAGE_SIZE, "%lu\n",

			(unsigned long) timeout_suspend_us);

}



static DEVICE_ATTR(timeout_suspend, 0664, timeout_suspend_show,
@@ -177,7 +178,7 @@ static ssize_t wakeups_xmit_show(struct device *d, 
				 char *buf)

{

	struct rmnet_private *p = netdev_priv(to_net_dev(d));

	return sprintf(buf, "%lu\n", p->wakeups_xmit);

	return snprintf(buf, PAGE_SIZE, "%lu\n", p->wakeups_xmit);

}



DEVICE_ATTR(wakeups_xmit, 0444, wakeups_xmit_show, NULL);
@@ -186,7 +187,7 @@ static ssize_t wakeups_rcv_show(struct device *d, struct device_attribute *attr, 
				char *buf)

{

	struct rmnet_private *p = netdev_priv(to_net_dev(d));

	return sprintf(buf, "%lu\n", p->wakeups_rcv);

	return snprintf(buf, PAGE_SIZE, "%lu\n", p->wakeups_rcv);

}



DEVICE_ATTR(wakeups_rcv, 0444, wakeups_rcv_show, NULL);
@@ -210,7 +211,7 @@ static ssize_t timeout_show(struct device *d, struct device_attribute *attr, 
{

	struct rmnet_private *p = netdev_priv(to_net_dev(d));

	p = netdev_priv(to_net_dev(d));

	return sprintf(buf, "%lu\n", timeout_us);

	return snprintf(buf, PAGE_SIZE, "%lu\n", timeout_us);

}



DEVICE_ATTR(timeout, 0664, timeout_show, timeout_store);