diff options
| author | Pavel Roskin <proski@gnu.org> | 2009-01-17 13:33:03 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-01-24 16:41:45 -0800 |
| commit | 6d5e1f0c50e18271cb9d5188378c6d577f648639 (patch) | |
| tree | 4b9e0fc810395f0e895c9e7148b7dbfc52dd19ad /drivers | |
| parent | c2ef76b4adfbb9439e0d9abad8903404f1e884c3 (diff) | |
dell_rbu: use scnprintf() instead of less secure sprintf()
commit 81156928f8fe31621e467490b9d441c0285998c3 upstream.
Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or
/sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an
oops.
Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/firmware/dell_rbu.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c index 13946ebd77d..b4704e150b2 100644 --- a/drivers/firmware/dell_rbu.c +++ b/drivers/firmware/dell_rbu.c @@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj, { int size = 0; if (!pos) - size = sprintf(buffer, "%s\n", image_type); + size = scnprintf(buffer, count, "%s\n", image_type); return size; } @@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj, int size = 0; if (!pos) { spin_lock(&rbu_data.lock); - size = sprintf(buffer, "%lu\n", rbu_data.packetsize); + size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize); spin_unlock(&rbu_data.lock); } return size; |