1 files changed, 6 insertions, 4 deletions

diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 5b3022470126..2f3cdb01506d 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -89,6 +89,7 @@
 
 /* Array sizes */
 #define VALIDATE_BUF_SIZE 4096    
+#define VALIDATE_MSG_LEN  256
 #define RTAS_MSG_MAXLEN   64
 
 /* Quirk - RTAS requires 4k list length and block size */
@@ -466,7 +467,7 @@ static void validate_flash(struct rtas_validate_flash_t *args_buf)
 }
 
 static int get_validate_flash_msg(struct rtas_validate_flash_t *args_buf, 
-                                   char *msg)
+                                   char *msg, int msglen)
 {
         int n;
 
@@ -474,7 +475,8 @@ static int get_validate_flash_msg(struct rtas_validate_flash_t *args_buf,
                 n = sprintf(msg, "%d\n", args_buf->update_results);
                 if ((args_buf->update_results >= VALIDATE_CUR_UNKNOWN) ||
                     (args_buf->update_results == VALIDATE_TMP_UPDATE))
-                        n += sprintf(msg + n, "%s\n", args_buf->buf);
+                        n += snprintf(msg + n, msglen - n, "%s\n",
+                                        args_buf->buf);
         } else {
                 n = sprintf(msg, "%d\n", args_buf->status);
         }
@@ -486,11 +488,11 @@ static ssize_t validate_flash_read(struct file *file, char __user *buf,
 {
         struct rtas_validate_flash_t *const args_buf =
                 &rtas_validate_flash_data;
-        char msg[RTAS_MSG_MAXLEN];
+        char msg[VALIDATE_MSG_LEN];
         int msglen;
 
         mutex_lock(&rtas_validate_flash_mutex);
-        msglen = get_validate_flash_msg(args_buf, msg);
+        msglen = get_validate_flash_msg(args_buf, msg, VALIDATE_MSG_LEN);
         mutex_unlock(&rtas_validate_flash_mutex);
 
         return simple_read_from_buffer(buf, count, ppos, msg, msglen);