Skip to content

Commit

Permalink
dell_rbu: use scnprintf() instead of less secure sprintf()
Browse files Browse the repository at this point in the history
Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or
/sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an
oops.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  • Loading branch information
Pavel Roskin authored and Linus Torvalds committed Jan 17, 2009
1 parent 0d54ee1 commit 8115692
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/firmware/dell_rbu.c
Original file line number Diff line number Diff line change
Expand Up @@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj,
{
int size = 0;
if (!pos)
size = sprintf(buffer, "%s\n", image_type);
size = scnprintf(buffer, count, "%s\n", image_type);
return size;
}

Expand Down Expand Up @@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj,
int size = 0;
if (!pos) {
spin_lock(&rbu_data.lock);
size = sprintf(buffer, "%lu\n", rbu_data.packetsize);
size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize);
spin_unlock(&rbu_data.lock);
}
return size;
Expand Down

0 comments on commit 8115692

Please sign in to comment.