aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/nubus/proc.c
diff options
context:
space:
mode:
authorFinn Thain <fthain@telegraphics.com.au>2018-01-13 17:37:13 -0500
committerGeert Uytterhoeven <geert@linux-m68k.org>2018-01-16 16:47:29 +0100
commit2f828fb21df42058084b16d5e07cecdc30dbc3a5 (patch)
treee4dd00df654ccc5b3119ea6b93ef94f326daf1c0 /drivers/nubus/proc.c
parent955999c9023290da18230b57df1f04187a43a4c0 (diff)
nubus: Avoid array underflow and overflow
Check array indices. Avoid sprintf. Use buffers of sufficient size. Use appropriate types for array length parameters. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Diffstat (limited to 'drivers/nubus/proc.c')
-rw-r--r--drivers/nubus/proc.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/drivers/nubus/proc.c b/drivers/nubus/proc.c
index 004a122ac0ff..fc20dbcd3b9a 100644
--- a/drivers/nubus/proc.c
+++ b/drivers/nubus/proc.c
@@ -73,10 +73,10 @@ static void nubus_proc_subdir(struct nubus_dev* dev,
/* Some of these are directories, others aren't */
while (nubus_readdir(dir, &ent) != -1) {
- char name[8];
+ char name[9];
struct proc_dir_entry* e;
- sprintf(name, "%x", ent.type);
+ snprintf(name, sizeof(name), "%x", ent.type);
e = proc_create(name, S_IFREG | S_IRUGO | S_IWUSR, parent,
&nubus_proc_subdir_fops);
if (!e)
@@ -95,11 +95,11 @@ static void nubus_proc_populate(struct nubus_dev* dev,
/* We know these are all directories (board resource + one or
more functional resources) */
while (nubus_readdir(root, &ent) != -1) {
- char name[8];
+ char name[9];
struct proc_dir_entry* e;
struct nubus_dir dir;
- sprintf(name, "%x", ent.type);
+ snprintf(name, sizeof(name), "%x", ent.type);
e = proc_mkdir(name, parent);
if (!e) return;
@@ -119,7 +119,7 @@ int nubus_proc_attach_device(struct nubus_dev *dev)
{
struct proc_dir_entry *e;
struct nubus_dir root;
- char name[8];
+ char name[9];
if (dev == NULL) {
printk(KERN_ERR
@@ -135,7 +135,7 @@ int nubus_proc_attach_device(struct nubus_dev *dev)
}
/* Create a directory */
- sprintf(name, "%x", dev->board->slot);
+ snprintf(name, sizeof(name), "%x", dev->board->slot);
e = dev->procdir = proc_mkdir(name, proc_bus_nubus_dir);
if (!e)
return -ENOMEM;

Privacy Policy