iio: iio_enum_available_read: Prevent possible buffer overflow

Use scnprint instead of snprintf, because snprintf returns the number of bytes
that would have been written to the buffer if there was enough space, and as a
result writing to buf[len-1] might cause a access beyond the buffers limits.

Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Lars-Peter Clausen <[email protected]>
Acked-by: Jonathan Cameron <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 56a3c0bc996c98f47bcd9633d24daecd8e4e239b..cf9ecd0ae7c9a8ed436bd6b6e22db4e31d1a813b 100644 (file)
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -300,7 +300,7 @@ ssize_t iio_enum_available_read(struct iio_dev *indio_dev,
                return 0;
 
        for (i = 0; i < e->num_items; ++i)
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s ", e->items[i]);
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s ", e->items[i]);
 
        /* replace last space with a newline */
        buf[len - 1] = '\n';