[PATCH] hwmon: (ibmpowernv) Use scnprintf() for avoiding potential buffer overflow

[Guenter Roeck]

On Wed, Mar 11, 2020 at 08:39:44AM +0100, Takashi Iwai wrote:
> Since snprintf() returns the would-be-output size instead of the
> actual output size, the succeeding calls may go beyond the given
> buffer limit.  Fix it by replacing with scnprintf().
> 
> Signed-off-by: Takashi Iwai <tiwai at suse.de>

Applied to hwmon-next.

Thanks,
Guenter

> ---
>  drivers/hwmon/ibmpowernv.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
> index 0e525cfbdfc5..a750647e66a4 100644
> --- a/drivers/hwmon/ibmpowernv.c
> +++ b/drivers/hwmon/ibmpowernv.c
> @@ -186,7 +186,7 @@ static void make_sensor_label(struct device_node *np,
>  	u32 id;
>  	size_t n;
>  
> -	n = snprintf(sdata->label, sizeof(sdata->label), "%s", label);
> +	n = scnprintf(sdata->label, sizeof(sdata->label), "%s", label);
>  
>  	/*
>  	 * Core temp pretty print
> @@ -199,11 +199,11 @@ static void make_sensor_label(struct device_node *np,
>  			 * The digital thermal sensors are associated
>  			 * with a core.
>  			 */
> -			n += snprintf(sdata->label + n,
> +			n += scnprintf(sdata->label + n,
>  				      sizeof(sdata->label) - n, " %d",
>  				      cpuid);
>  		else
> -			n += snprintf(sdata->label + n,
> +			n += scnprintf(sdata->label + n,
>  				      sizeof(sdata->label) - n, " phy%d", id);
>  	}
>  
> @@ -211,7 +211,7 @@ static void make_sensor_label(struct device_node *np,
>  	 * Membuffer pretty print
>  	 */
>  	if (!of_property_read_u32(np, "ibm,chip-id", &id))
> -		n += snprintf(sdata->label + n, sizeof(sdata->label) - n,
> +		n += scnprintf(sdata->label + n, sizeof(sdata->label) - n,
>  			      " %d", id & 0xffff);
>  }
>  
> -- 
> 2.16.4
>