Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1353390

[RFC 5/7] wlcore: avoid fragile snprintf use

Show all headers | View raw

Appending to a buffer like this is not guaranteed to work (passing
overlapping src and dst buffers to snprintf is undefined
behaviour). The standard and safe idiom is to keep track of the
current string length.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
---
 drivers/net/wireless/ti/wlcore/boot.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c
index 19b7ec7b69c2..401d75c02bf4 100644
--- a/drivers/net/wireless/ti/wlcore/boot.c
+++ b/drivers/net/wireless/ti/wlcore/boot.c
@@ -86,7 +86,7 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)
 	unsigned int *min_ver = (wl->fw_type == WL12XX_FW_TYPE_MULTI) ?
 		wl->min_mr_fw_ver : wl->min_sr_fw_ver;
 	char min_fw_str[32] = "";
-	int i;
+	int i, len;
 
 	/* the chip must be exactly equal */
 	if ((min_ver[FW_VER_CHIP] != WLCORE_FW_VER_IGNORE) &&
@@ -119,13 +119,15 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)
 	return 0;
 
 fail:
+	len = 0;
 	for (i = 0; i < NUM_FW_VER; i++)
 		if (min_ver[i] == WLCORE_FW_VER_IGNORE)
-			snprintf(min_fw_str, sizeof(min_fw_str),
-				  "%s*.", min_fw_str);
+			len += scnprintf(min_fw_str + len,
+					 sizeof(min_fw_str) - len, "*.");
 		else
-			snprintf(min_fw_str, sizeof(min_fw_str),
-				  "%s%u.", min_fw_str, min_ver[i]);
+			len += scnprintf(min_fw_str + len,
+					 sizeof(min_fw_str) - len,
+					 "%u.", min_ver[i]);
 
 	wl1271_error("Your WiFi FW version (%u.%u.%u.%u.%u) is invalid.\n"
 		     "Please use at least FW %s\n"
-- 
2.1.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC 0/7] eliminate snprintf with overlapping src and dst Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-03-08 21:50 +0100
  [RFC 5/7] wlcore: avoid fragile snprintf use Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-03-08 21:50 +0100
    Re: [RFC 5/7] wlcore: avoid fragile snprintf use Kalle Valo <kvalo@codeaurora.org> - 2016-03-09 12:50 +0100
  [RFC 3/7] leds: avoid fragile sprintf use Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-03-08 21:50 +0100
  [RFC 4/7] drivers/media/pci/zoran: avoid fragile snprintf use Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-03-08 21:50 +0100
  [RFC 2/7] Input: joystick - avoid fragile snprintf use Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-03-08 21:50 +0100
    Re: [RFC 2/7] Input: joystick - avoid fragile snprintf use Andy Shevchenko <andy.shevchenko@gmail.com> - 2016-03-09 07:50 +0100
  [RFC 1/7] drm/amdkfd: avoid fragile and inefficient snprintf use Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-03-08 21:50 +0100
    Re: [RFC 1/7] drm/amdkfd: avoid fragile and inefficient snprintf use Oded Gabbay <oded.gabbay@gmail.com> - 2016-03-14 15:40 +0100
      Re: [RFC 1/7] drm/amdkfd: avoid fragile and inefficient snprintf use Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-03-14 20:20 +0100
  Re: [RFC 0/7] eliminate snprintf with overlapping src and dst Kees Cook <keescook@chromium.org> - 2016-03-09 00:10 +0100
  Re: [RFC 0/7] eliminate snprintf with overlapping src and dst Kees Cook <keescook@chromium.org> - 2016-03-09 00:20 +0100
  Re: [RFC 0/7] eliminate snprintf with overlapping src and dst Andy Shevchenko <andy.shevchenko@gmail.com> - 2016-03-09 08:00 +0100
  Re: [RFC 0/7] eliminate snprintf with overlapping src and dst Andrew Morton <akpm@linux-foundation.org> - 2016-03-09 21:50 +0100
    Re: [RFC 0/7] eliminate snprintf with overlapping src and dst Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-03-09 23:20 +0100
    Re: [RFC 0/7] eliminate snprintf with overlapping src and dst One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-03-10 15:10 +0100

csiph-web