s2io: use snprintf() as a safety feature

PATCH Applied Dan Carpenter 2 participants 2 messages Jan 19, 2015 – Jan 20, 2015

Subsystems (3)

Networking Network drivers Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2015-01-19 19:34 UTC #0 lore raw

PATCH 1/1 s2io: use snprintf() as a safety feature

"sp->desc[i]" has 25 characters. "dev->name" has 15 characters. If we used all 15 characters then the sprintf() would overflow.

I changed the "sprintf(sp->name, "%s Neterion %s"" to snprintf(), as well, even though it can't overflow just to be consistent.

Signed-off-by Dan Carpenter <[email protected]>

---
This driver is quite old.

drivers/net/ethernet/neterion/s2io.c +0 -0

0529cad..a4cdf2f 100644

drivers/net/ethernet/neterion/s2io.c +8 -3

@@ -6987,7 +6987,9 @@ static int s2io_add_isr(struct s2io_nic *sp)
 			if (sp->s2io_entries[i].in_use == MSIX_FLG) {
 				if (sp->s2io_entries[i].type ==
 				    MSIX_RING_TYPE) {
-					sprintf(sp->desc[i], "%s:MSI-X-%d-RX",
+					snprintf(sp->desc[i],
+						sizeof(sp->desc[i]),
+						"%s:MSI-X-%d-RX",
 						dev->name, i);
 					err = request_irq(sp->entries[i].vector,
 							  s2io_msix_ring_handle,

@@ -6996,7 +6998,9 @@ static int s2io_add_isr(struct s2io_nic *sp)
 							  sp->s2io_entries[i].arg);
 				} else if (sp->s2io_entries[i].type ==
 					   MSIX_ALARM_TYPE) {
-					sprintf(sp->desc[i], "%s:MSI-X-%d-TX",
+					snprintf(sp->desc[i],
+						sizeof(sp->desc[i]),
+						"%s:MSI-X-%d-TX",
 						dev->name, i);
 					err = request_irq(sp->entries[i].vector,
 							  s2io_msix_fifo_handle,

@@ -8154,7 +8158,8 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
 			  "%s: UDP Fragmentation Offload(UFO) enabled\n",
 			  dev->name);
 	/* Initialize device name */
-	sprintf(sp->name, "%s Neterion %s", dev->name, sp->product_name);
+	snprintf(sp->name, sizeof(sp->name), "%s Neterion %s", dev->name,
+		 sp->product_name);
 
 	if (vlan_tag_strip)
 		sp->vlan_strip_flag = 1;

David Miller

maintainer Applied

2015-01-20 00:45 UTC #1 lore raw

From: Dan Carpenter <[email protected]>
Date: Mon, 19 Jan 2015 22:34:51 +0300

Quoted 7 lines

"sp->desc[i]" has 25 characters. "dev->name" has 15 characters. If we used all 15 characters then the sprintf() would overflow.
I changed the "sprintf(sp->name, "%s Neterion %s"" to snprintf(), as well, even though it can't overflow just to be consistent.
Signed-off-by Dan Carpenter <[email protected]>

Applied, thanks Dan.