iio: force snprintf for PAGE_SIZE bufs

PATCH Applied Kees Cook 2 participants 2 messages Mar 13, 2014 – Mar 15, 2014 IIO

Share & tools

Kees Cook

author

2014-03-13 16:46 UTC #0 lore raw

PATCH 1/1 iio: force snprintf for PAGE_SIZE bufs

This is a tiny preventative measure to make sure we can't write beyond PAGE_SIZE on the buffers being used in sysfs for iio. There is currently no way for this to happen, but the change makes this code more robust for the future.

Signed-off-by Kees Cook <[email protected]>

---
 drivers/iio/industrialio-core.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/iio/industrialio-core.c +2 -2

index acc911a836ca..64bb64f35af8 100644
@@ -340,7 +340,7 @@ ssize_t iio_enum_read(struct iio_dev *indio_dev,
 	else if (i >= e->num_items)
 		return -EINVAL;
 
-	return sprintf(buf, "%s\n", e->items[i]);
+	return snprintf(buf, PAGE_SIZE, "%s\n", e->items[i]);
 }
 EXPORT_SYMBOL_GPL(iio_enum_read);

@@ -836,7 +836,7 @@ static ssize_t iio_show_dev_name(struct device *dev,
 				 char *buf)
 {
 	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-	return sprintf(buf, "%s\n", indio_dev->name);
+	return snprintf(buf, PAGE_SIZE, "%s\n", indio_dev->name);
 }
 
 static DEVICE_ATTR(name, S_IRUGO, iio_show_dev_name, NULL);

Signature · 6 lines

1.7.9.5


-- 
Kees Cook
Chrome OS Security

Jonathan Cameron

maintainer Applied

2014-03-15 14:44 UTC #1 lore raw

Quoted 6 lines · Kees Cook

This is a tiny preventative measure to make sure we can't write beyond PAGE_SIZE on the buffers being used in sysfs for iio. There is currently no way for this to happen, but the change makes this code more robust for the future.
Signed-off-by Kees Cook <[email protected]>

A sensible enough change I guess.

Applied to the togreg branch of iio.git

Jonathan

Quoted 27 lines

---
  drivers/iio/industrialio-core.c |    4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

drivers/iio/industrialio-core.c +2 -2

index acc911a836ca..64bb64f35af8 100644
@@ -340,7 +340,7 @@ ssize_t iio_enum_read(struct iio_dev *indio_dev,
  	else if (i >= e->num_items)
  		return -EINVAL;
 
-	return sprintf(buf, "%s\n", e->items[i]);
+	return snprintf(buf, PAGE_SIZE, "%s\n", e->items[i]);
  }
  EXPORT_SYMBOL_GPL(iio_enum_read);

@@ -836,7 +836,7 @@ static ssize_t iio_show_dev_name(struct device *dev,
  				 char *buf)
  {
  	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-	return sprintf(buf, "%s\n", indio_dev->name);
+	return snprintf(buf, PAGE_SIZE, "%s\n", indio_dev->name);
  }
 
  static DEVICE_ATTR(name, S_IRUGO, iio_show_dev_name, NULL);