thermal: core: prevent potential string overflow
The dev->id value comes from ida_alloc() so it's a number between zero
and INT_MAX. If it's too high then these sprintf()s will overflow.
Fixes: 203d3d4aa4
("the generic thermal sysfs driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
parent
e17ea8a1b1
commit
c99626092e
@ -681,7 +681,8 @@ int thermal_bind_cdev_to_trip(struct thermal_zone_device *tz,
|
||||
if (result)
|
||||
goto release_ida;
|
||||
|
||||
sprintf(dev->attr_name, "cdev%d_trip_point", dev->id);
|
||||
snprintf(dev->attr_name, sizeof(dev->attr_name), "cdev%d_trip_point",
|
||||
dev->id);
|
||||
sysfs_attr_init(&dev->attr.attr);
|
||||
dev->attr.attr.name = dev->attr_name;
|
||||
dev->attr.attr.mode = 0444;
|
||||
@ -690,7 +691,8 @@ int thermal_bind_cdev_to_trip(struct thermal_zone_device *tz,
|
||||
if (result)
|
||||
goto remove_symbol_link;
|
||||
|
||||
sprintf(dev->weight_attr_name, "cdev%d_weight", dev->id);
|
||||
snprintf(dev->weight_attr_name, sizeof(dev->weight_attr_name),
|
||||
"cdev%d_weight", dev->id);
|
||||
sysfs_attr_init(&dev->weight_attr.attr);
|
||||
dev->weight_attr.attr.name = dev->weight_attr_name;
|
||||
dev->weight_attr.attr.mode = S_IWUSR | S_IRUGO;
|
||||
|
Loading…
Reference in New Issue
Block a user