From 20319b7746737256d5df8624fc87cd6ace2a8337 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 24 Jan 2013 09:41:43 +0300
Subject: [PATCH] --- yaml --- r: 354146 b: refs/heads/master c:
 96a8d14e875a017f9e9e71d93433414e9fb8863f h: refs/heads/master v: v3

---
 [refs]                               | 2 +-
 trunk/drivers/staging/cxt1e1/linux.c | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 751ef492534c..b147fda156d8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 392c6ff87f568d573239b763855160d1f06114de
+refs/heads/master: 96a8d14e875a017f9e9e71d93433414e9fb8863f
diff --git a/trunk/drivers/staging/cxt1e1/linux.c b/trunk/drivers/staging/cxt1e1/linux.c
index 0ff2865edec8..a829b6231a66 100644
--- a/trunk/drivers/staging/cxt1e1/linux.c
+++ b/trunk/drivers/staging/cxt1e1/linux.c
@@ -773,7 +773,9 @@ do_del_chan (struct net_device * musycc_dev, void *data)
     if (copy_from_user (&cp, data,
                         sizeof (struct sbecom_chan_param)))
         return -EFAULT;
-    sprintf (buf, CHANNAME "%d", cp.channum);
+    if (cp.channum > 999)
+        return -EINVAL;
+    snprintf (buf, sizeof(buf), CHANNAME "%d", cp.channum);
     if (!(dev = dev_get_by_name (&init_net, buf)))
         return -ENOENT;
     dev_put (dev);