Messages in this thread Patch in this message | | | Date | Sun, 7 Dec 2008 17:31:19 -0500 (EST) | From | Anders Kaseorg <> | Subject | [PATCH] Don't call snprintf() with overlapping input and output. |
| |
The use of snprintf() to append to a buffer, as in snprintf(codec->name, sizeof(codec->name), "%s[%d]", codec->name, h->attached) is not valid according to C99 ("If copying takes place between objects that overlap, the behavior is undefined."). It breaks at least in userspace under gcc -D_FORTIFY_SOURCE. Replace this construct with snprintf(codec->name + strlen(codec->name), sizeof(codec->name) - strlen(codec->name), "[%d]", h->attached);
Signed-off-by: Anders Kaseorg <andersk@mit.edu> --- arch/mips/bcm47xx/prom.c | 5 +++-- drivers/input/joystick/analog.c | 5 +++-- drivers/input/misc/ati_remote.c | 5 +++-- drivers/media/video/zoran/videocodec.c | 5 +++-- 4 files changed, 12 insertions(+), 8 deletions(-)
diff --git a/arch/mips/bcm47xx/prom.c b/arch/mips/bcm47xx/prom.c index 079e33d..c91e3b2 100644 --- a/arch/mips/bcm47xx/prom.c +++ b/arch/mips/bcm47xx/prom.c @@ -118,8 +118,9 @@ static __init void prom_init_cmdline(void) strcpy(buf, "uart0");
/* Compute the new command line */ - snprintf(arcs_cmdline, CL_SIZE, "%s console=ttyS%c,115200", - arcs_cmdline, buf[4]); + snprintf(arcs_cmdline + strlen(arcs_cmdline), + CL_SIZE - strlen(arcs_cmdline), + " console=ttyS%c,115200", buf[4]); } }
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c index 356b3a2..2fe178e 100644 --- a/drivers/input/joystick/analog.c +++ b/drivers/input/joystick/analog.c @@ -412,8 +412,9 @@ static void analog_name(struct analog *analog) hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4);
if (analog->mask & ANALOG_HATS_ALL) - snprintf(analog->name, sizeof(analog->name), "%s %d-hat", - analog->name, hweight16(analog->mask & ANALOG_HATS_ALL)); + snprintf(analog->name + strlen(analog->name), + sizeof(analog->name) - strlen(analog->name), + " %d-hat", hweight16(analog->mask & ANALOG_HATS_ALL));
if (analog->mask & ANALOG_HAT_FCS) strlcat(analog->name, " FCS", sizeof(analog->name)); diff --git a/drivers/input/misc/ati_remote.c b/drivers/input/misc/ati_remote.c index e290fde..f46ce58 100644 --- a/drivers/input/misc/ati_remote.c +++ b/drivers/input/misc/ati_remote.c @@ -772,8 +772,9 @@ static int ati_remote_probe(struct usb_interface *interface, const struct usb_de strlcpy(ati_remote->name, udev->manufacturer, sizeof(ati_remote->name));
if (udev->product) - snprintf(ati_remote->name, sizeof(ati_remote->name), - "%s %s", ati_remote->name, udev->product); + snprintf(ati_remote->name + strlen(ati_remote->name), + sizeof(ati_remote->name) - strlen(ati_remote->name), + " %s", udev->product);
if (!strlen(ati_remote->name)) snprintf(ati_remote->name, sizeof(ati_remote->name), diff --git a/drivers/media/video/zoran/videocodec.c b/drivers/media/video/zoran/videocodec.c index cf24956..dbcfaef 100644 --- a/drivers/media/video/zoran/videocodec.c +++ b/drivers/media/video/zoran/videocodec.c @@ -117,8 +117,9 @@ videocodec_attach (struct videocodec_master *master) } memcpy(codec, h->codec, sizeof(struct videocodec));
- snprintf(codec->name, sizeof(codec->name), - "%s[%d]", codec->name, h->attached); + snprintf(codec->name + strlen(codec->name), + sizeof(codec->name) - strlen(codec->name), + "[%d]", h->attached); codec->master_data = master; res = codec->setup(codec); if (res == 0) { -- 1.6.0.4
| |