]> www.infradead.org Git - users/jedix/linux-maple.git/commit
USB: yurex: Check for truncation in yurex_read()
authorBen Hutchings <ben.hutchings@codethink.co.uk>
Wed, 15 Aug 2018 20:45:37 +0000 (21:45 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 10 Oct 2018 06:54:24 +0000 (08:54 +0200)
commita90a52c51ad46b8c1407b1113aabd8cf6e7c197d
tree016225163f02492131368538b28ad172e24b918d
parent2c423318f07ccde11162e40f2bd4c47bbe9a00cf
USB: yurex: Check for truncation in yurex_read()

[ Upstream commit 14427b86837a4baf1c121934c6599bdb67dfa9fc ]

snprintf() always returns the full length of the string it could have
printed, even if it was truncated because the buffer was too small.
So in case the counter value is truncated, we will over-read from
in_buffer and over-write to the caller's buffer.

I don't think it's actually possible for this to happen, but in case
truncation occurs, WARN and return -EIO.

Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/misc/yurex.c