From: Pavel Roskin Date: Sat, 17 Jan 2009 18:33:03 +0000 (-0500) Subject: dell_rbu: use scnprintf() instead of less secure sprintf() X-Git-Tag: v2.6.29-rc3~48 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=81156928f8fe31621e467490b9d441c0285998c3;p=linux-2.6-omap-h63xx.git dell_rbu: use scnprintf() instead of less secure sprintf() Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or /sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an oops. Signed-off-by: Pavel Roskin Signed-off-by: Linus Torvalds --- diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c index 13946ebd77d..b4704e150b2 100644 --- a/drivers/firmware/dell_rbu.c +++ b/drivers/firmware/dell_rbu.c @@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj, { int size = 0; if (!pos) - size = sprintf(buffer, "%s\n", image_type); + size = scnprintf(buffer, count, "%s\n", image_type); return size; } @@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj, int size = 0; if (!pos) { spin_lock(&rbu_data.lock); - size = sprintf(buffer, "%lu\n", rbu_data.packetsize); + size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize); spin_unlock(&rbu_data.lock); } return size;