diff mbox

[04/12] ARM: OMAP3: mmc-twl4030 fix name buffer length

Message ID 20090316174255.GC19229@atomide.com (mailing list archive)
State Awaiting Upstream, archived
Headers show

Commit Message

Tony Lindgren March 16, 2009, 5:42 p.m. UTC 
* Russell King - ARM Linux <linux@arm.linux.org.uk> [090316 03:14]:
> On Mon, Mar 16, 2009 at 12:04:39PM +0200, Adrian Hunter wrote:
> > Russell King - ARM Linux wrote:
> >> On Tue, Mar 10, 2009 at 02:06:08PM -0700, Tony Lindgren wrote:
> >>> From: Adrian Hunter <adrian.hunter@nokia.com>
> >>>
> >>> Add 1 to buffer length for null terminator.
> >>
> >> Yes, and:
> >>
> >>                 sprintf(twl->name, "mmc%islot%i", c->mmc, 1);
> >>
> >> should be snprintf to ensure that it can't overflow the buffer.
> >>
> >
> > There are only 3 controllers and everyone numbers them 1, 2 and 3.
> 
> So?  You've already had a buffer overflow, so it's clearly time that this
> code got fixed properly.

Here's this one updated to also include the snprintf.

Tony

Comments

Russell King - ARM Linux March 16, 2009, 10:22 p.m. UTC | #1 
On Mon, Mar 16, 2009 at 10:42:56AM -0700, Tony Lindgren wrote:
> * Russell King - ARM Linux <linux@arm.linux.org.uk> [090316 03:14]:
> > On Mon, Mar 16, 2009 at 12:04:39PM +0200, Adrian Hunter wrote:
> > > Russell King - ARM Linux wrote:
> > >> On Tue, Mar 10, 2009 at 02:06:08PM -0700, Tony Lindgren wrote:
> > >>> From: Adrian Hunter <adrian.hunter@nokia.com>
> > >>>
> > >>> Add 1 to buffer length for null terminator.
> > >>
> > >> Yes, and:
> > >>
> > >>                 sprintf(twl->name, "mmc%islot%i", c->mmc, 1);
> > >>
> > >> should be snprintf to ensure that it can't overflow the buffer.
> > >>
> > >
> > > There are only 3 controllers and everyone numbers them 1, 2 and 3.
> > 
> > So?  You've already had a buffer overflow, so it's clearly time that this
> > code got fixed properly.
> 
> Here's this one updated to also include the snprintf.

Ok.
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

From 42a81558d840eb69204edb39169227547831dd1b Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@nokia.com>
Date: Mon, 16 Mar 2009 10:32:33 -0700
Subject: [PATCH] ARM: OMAP3: mmc-twl4030 fix name buffer length, v2

Add 1 to buffer length for null terminator and use snprintf.

Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Tony Lindgren <tony@atomide.com>

diff --git a/arch/arm/mach-omap2/mmc-twl4030.c b/arch/arm/mach-omap2/mmc-twl4030.c
index 437f520..84cac87 100644
--- a/arch/arm/mach-omap2/mmc-twl4030.c
+++ b/arch/arm/mach-omap2/mmc-twl4030.c
@@ -59,7 +59,7 @@  static struct twl_mmc_controller {
 	struct omap_mmc_platform_data	*mmc;
 	u8		twl_vmmc_dev_grp;
 	u8		twl_mmc_dedicated;
-	char		name[HSMMC_NAME_LEN];
+	char		name[HSMMC_NAME_LEN + 1];
 } hsmmc[] = {
 	{
 		.twl_vmmc_dev_grp		= VMMC1_DEV_GRP,
@@ -349,7 +349,8 @@  void __init twl4030_mmc_init(struct twl4030_hsmmc_info *controllers)
 			return;
 		}
 
-		sprintf(twl->name, "mmc%islot%i", c->mmc, 1);
+		snprintf(twl->name, ARRAY_SIZE(twl->name), "mmc%islot%i",
+				c->mmc, 1);
 		mmc->slots[0].name = twl->name;
 		mmc->nr_slots = 1;
 		mmc->slots[0].ocr_mask = MMC_VDD_165_195 |