diff options
author | Pavel Roskin <proski@gnu.org> | 2009-01-17 13:33:03 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-01-17 17:27:18 -0500 |
commit | 81156928f8fe31621e467490b9d441c0285998c3 (patch) | |
tree | 9ee408f5947d318b21164fb085518f2d93747af6 /drivers/firmware | |
parent | 0d54ee1c7850a954026deec4cd4885f331da35cc (diff) |
dell_rbu: use scnprintf() instead of less secure sprintf()
Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or
/sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an
oops.
Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/firmware')
-rw-r--r-- | drivers/firmware/dell_rbu.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c index 13946ebd77d..b4704e150b2 100644 --- a/drivers/firmware/dell_rbu.c +++ b/drivers/firmware/dell_rbu.c | |||
@@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj, | |||
576 | { | 576 | { |
577 | int size = 0; | 577 | int size = 0; |
578 | if (!pos) | 578 | if (!pos) |
579 | size = sprintf(buffer, "%s\n", image_type); | 579 | size = scnprintf(buffer, count, "%s\n", image_type); |
580 | return size; | 580 | return size; |
581 | } | 581 | } |
582 | 582 | ||
@@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj, | |||
648 | int size = 0; | 648 | int size = 0; |
649 | if (!pos) { | 649 | if (!pos) { |
650 | spin_lock(&rbu_data.lock); | 650 | spin_lock(&rbu_data.lock); |
651 | size = sprintf(buffer, "%lu\n", rbu_data.packetsize); | 651 | size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize); |
652 | spin_unlock(&rbu_data.lock); | 652 | spin_unlock(&rbu_data.lock); |
653 | } | 653 | } |
654 | return size; | 654 | return size; |