Skip to contentSkip to conversation

Fix out of bounds memory access

PATCH Applied Thomas Jarosch 2 participants 2 messages Dec 25, 2012 – Jan 6, 2013

lore
Share & tools
lore

Thomas Jarosch

author
#0 lore raw

PATCH 1/1 Fix out of bounds memory access

cppcheck reported:
[tools/intel_infoframes.c:836]: (error) Width 31 given in format string (no. 1) is larger than destination buffer 'option[16]',
use %15s to prevent overflowing it.

Signed-off-by Thomas Jarosch <[email protected]>
---
 tools/intel_infoframes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/intel_infoframes.c +1 -1
index 66351ac..09fdcb9 100644
@@ -833,7 +833,7 @@ static void change_spd_infoframe(Transcoder transcoder, char *commands)
 	val = INREG(reg);
 
 	while (1) {
-		rc = sscanf(current, "%31s%n", option, &read);
+		rc = sscanf(current, "%15s%n", option, &read);
 		current = &current[read];
 		if (rc == EOF) {
 			break;
Signature · 1 line
1.7.11.7
Applied
#1 lore raw
Quoted 6 lines · Thomas Jarosch

cppcheck reported:
[tools/intel_infoframes.c:836]: (error) Width 31 given in format string (no. 1) is larger than destination buffer 'option[16]',
use %15s to prevent overflowing it.

Signed-off-by Thomas Jarosch <[email protected]>

Applied, thanks for the patch.
-Daniel

Quoted 24 lines
---
 tools/intel_infoframes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/intel_infoframes.c +1 -1
index 66351ac..09fdcb9 100644
@@ -833,7 +833,7 @@ static void change_spd_infoframe(Transcoder transcoder, char *commands)
 	val = INREG(reg);
 
 	while (1) {
-		rc = sscanf(current, "%31s%n", option, &read);
+		rc = sscanf(current, "%15s%n", option, &read);
 		current = &current[read];
 		if (rc == EOF) {
 			break;
Signature · 6 lines
1.7.11.7

_______________________________________________
Intel-gfx mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/intel-gfx
Signature · 3 lines
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch