Commit 7d7f7944 authored by Lee Jones's avatar Lee Jones Committed by Greg Kroah-Hartman
Browse files

usb: fotg210-hcd: Replace snprintf() with the safer scnprintf() variant 

There is a general misunderstanding amongst engineers that {v}snprintf()
returns the length of the data *actually* encoded into the destination
array.  However, as per the C99 standard {v}snprintf() really returns
the length of the data that *would have been* written if there were
enough space for it.  This misunderstanding has led to buffer-overruns
in the past.  It's generally considered safer to use the {v}scnprintf()
variants in their place (or even sprintf() in simple cases).  So let's
do that.

The uses in this file both seem to assume that data *has been* written!

Link: https://lwn.net/Articles/69419/
Link: https://github.com/KSPP/linux/issues/105


Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Yuan-Hsin Chen <yhchen@faraday-tech.com>
Cc: Feng-Hsin Chiang <john453@faraday-tech.com>
Cc: Po-Yu Chuang <ratbert.chuang@gmail.com>
Cc: linux-usb@vger.kernel.org
Signed-off-by: default avatarLee Jones <lee@kernel.org>
Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20231130105459.3208986-4-lee@kernel.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b385ef08

drivers/usb/fotg210/fotg210-hcd.c

+4 −8
Original line number Diff line number Diff line
@@ -404,7 +404,7 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh, 
			else if (td->hw_alt_next != list_end)

				mark = '/';

		}

		temp = snprintf(next, size,

		temp = scnprintf(next, size,

				 "\n\t%p%c%s len=%d %08x urb %p",

				 td, mark, ({ char *tmp;

				switch ((scratch>>8)&0x03) {
@@ -424,17 +424,13 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh, 
				(scratch >> 16) & 0x7fff,

				scratch,

				td->urb);

		if (size < temp)

			temp = size;

		size -= temp;

		next += temp;

		if (temp == size)

			goto done;

	}



	temp = snprintf(next, size, "\n");

	if (size < temp)

		temp = size;

	temp = scnprintf(next, size, "\n");



	size -= temp;

	next += temp;