OSDN Git Service

isdn: divert: fix sprintf buffer overflow warning
authorArnd Bergmann <arnd@arndb.de>
Fri, 14 Jul 2017 12:07:00 +0000 (14:07 +0200)
committerDavid S. Miller <davem@davemloft.net>
Fri, 14 Jul 2017 16:03:11 +0000 (09:03 -0700)
One string we pass into the cs->info buffer might be too long,
as pointed out by gcc:

drivers/isdn/divert/isdn_divert.c: In function 'll_callback':
drivers/isdn/divert/isdn_divert.c:488:22: error: '%d' directive writing between 1 and 3 bytes into a region of size between 1 and 69 [-Werror=format-overflow=]
 sprintf(cs->info, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n",
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/isdn/divert/isdn_divert.c:488:22: note: directive argument in the range [0, 255]
drivers/isdn/divert/isdn_divert.c:488:4: note: 'sprintf' output 25 or more bytes (assuming 129) into a destination of size 90

This is unlikely to actually cause problems, so let's use snprintf
as a simple workaround to shut  up the warning and truncate the
buffer instead.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/isdn/divert/isdn_divert.c

index 060d357..6f423bc 100644 (file)
@@ -485,18 +485,19 @@ static int isdn_divert_icall(isdn_ctrl *ic)
                                cs->deflect_dest[0] = '\0';
                                retval = 4; /* only proceed */
                        }
-                       sprintf(cs->info, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n",
-                               cs->akt_state,
-                               cs->divert_id,
-                               divert_if.drv_to_name(cs->ics.driver),
-                               (ic->command == ISDN_STAT_ICALLW) ? "1" : "0",
-                               cs->ics.parm.setup.phone,
-                               cs->ics.parm.setup.eazmsn,
-                               cs->ics.parm.setup.si1,
-                               cs->ics.parm.setup.si2,
-                               cs->ics.parm.setup.screen,
-                               dv->rule.waittime,
-                               cs->deflect_dest);
+                       snprintf(cs->info, sizeof(cs->info),
+                                "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n",
+                                cs->akt_state,
+                                cs->divert_id,
+                                divert_if.drv_to_name(cs->ics.driver),
+                                (ic->command == ISDN_STAT_ICALLW) ? "1" : "0",
+                                cs->ics.parm.setup.phone,
+                                cs->ics.parm.setup.eazmsn,
+                                cs->ics.parm.setup.si1,
+                                cs->ics.parm.setup.si2,
+                                cs->ics.parm.setup.screen,
+                                dv->rule.waittime,
+                                cs->deflect_dest);
                        if ((dv->rule.action == DEFLECT_REPORT) ||
                            (dv->rule.action == DEFLECT_REJECT)) {
                                put_info_buffer(cs->info);