diff mbox

[intel-gpu-tools] Fix out of bounds memory access

Message ID 50D9DD31.4030601@intra2net.com (mailing list archive)
State New, archived
Headers show

Commit Message

Thomas Jarosch Dec. 25, 2012, 5:06 p.m. UTC 
cppcheck reported:
[tools/intel_infoframes.c:836]: (error) Width 31 given in format string
(no. 1) is larger than destination buffer 'option[16]',
use %15s to prevent overflowing it.

Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
---
 tools/intel_infoframes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Daniel Vetter Jan. 6, 2013, 5:21 p.m. UTC | #1 
On Tue, Dec 25, 2012 at 06:06:57PM +0100, Thomas Jarosch wrote:
> cppcheck reported:
> [tools/intel_infoframes.c:836]: (error) Width 31 given in format string
> (no. 1) is larger than destination buffer 'option[16]',
> use %15s to prevent overflowing it.
> 
> Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>

Applied, thanks for the patch.
-Daniel

> ---
>  tools/intel_infoframes.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/intel_infoframes.c b/tools/intel_infoframes.c
> index 66351ac..09fdcb9 100644
> --- a/tools/intel_infoframes.c
> +++ b/tools/intel_infoframes.c
> @@ -833,7 +833,7 @@ static void change_spd_infoframe(Transcoder transcoder, char *commands)
>  	val = INREG(reg);
>  
>  	while (1) {
> -		rc = sscanf(current, "%31s%n", option, &read);
> +		rc = sscanf(current, "%15s%n", option, &read);
>  		current = &current[read];
>  		if (rc == EOF) {
>  			break;
> -- 
> 1.7.11.7
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx
diff mbox

Patch

diff --git a/tools/intel_infoframes.c b/tools/intel_infoframes.c
index 66351ac..09fdcb9 100644
--- a/tools/intel_infoframes.c
+++ b/tools/intel_infoframes.c
@@ -833,7 +833,7 @@  static void change_spd_infoframe(Transcoder transcoder, char *commands)
 	val = INREG(reg);
 
 	while (1) {
-		rc = sscanf(current, "%31s%n", option, &read);
+		rc = sscanf(current, "%15s%n", option, &read);
 		current = &current[read];
 		if (rc == EOF) {
 			break;