|
 |
c01703 |
From def2845efacab3a3973fb0218ac5077a162f8f1e Mon Sep 17 00:00:00 2001
|
|
|
c01703 |
From: Jean Delvare <jdelvare@suse.de>
|
|
|
c01703 |
Date: Thu, 2 Nov 2017 16:17:50 +0100
|
|
|
c01703 |
Subject: [PATCH 1/3] i2c-tools: i2cbusses: Avoid buffer overflows in sysfs
|
|
|
c01703 |
paths
|
|
|
c01703 |
|
|
|
c01703 |
sprintf isn't safe, use snprintf instead.
|
|
|
c01703 |
---
|
|
|
c01703 |
CHANGES | 3 +++
|
|
|
c01703 |
tools/i2cbusses.c | 10 +++++-----
|
|
|
c01703 |
2 files changed, 8 insertions(+), 5 deletions(-)
|
|
|
c01703 |
|
|
|
c01703 |
diff --git a/CHANGES b/CHANGES
|
|
|
c01703 |
index 15ff761..539adb0 100644
|
|
|
c01703 |
--- a/CHANGES
|
|
|
c01703 |
+++ b/CHANGES
|
|
|
c01703 |
@@ -1,6 +1,9 @@
|
|
|
c01703 |
i2c-tools CHANGES
|
|
|
c01703 |
-----------------
|
|
|
c01703 |
|
|
|
c01703 |
+master
|
|
|
c01703 |
+ tools: Fix potential buffer overflows in i2cbusses
|
|
|
c01703 |
+
|
|
|
c01703 |
4.0 (2017-10-30)
|
|
|
c01703 |
tools: Fix build with recent compilers (gcc 4.6+)
|
|
|
c01703 |
Add examples to the manual pages
|
|
|
c01703 |
diff --git a/tools/i2cbusses.c b/tools/i2cbusses.c
|
|
|
c01703 |
index dad22ea..cb78cc7 100644
|
|
|
c01703 |
--- a/tools/i2cbusses.c
|
|
|
c01703 |
+++ b/tools/i2cbusses.c
|
|
|
c01703 |
@@ -220,18 +220,18 @@ struct i2c_adap *gather_i2c_busses(void)
|
|
|
c01703 |
|
|
|
c01703 |
/* this should work for kernels 2.6.5 or higher and */
|
|
|
c01703 |
/* is preferred because is unambiguous */
|
|
|
c01703 |
- sprintf(n, "%s/%s/name", sysfs, de->d_name);
|
|
|
c01703 |
+ snprintf(n, NAME_MAX, "%s/%s/name", sysfs, de->d_name);
|
|
|
c01703 |
f = fopen(n, "r");
|
|
|
c01703 |
/* this seems to work for ISA */
|
|
|
c01703 |
if(f == NULL) {
|
|
|
c01703 |
- sprintf(n, "%s/%s/device/name", sysfs, de->d_name);
|
|
|
c01703 |
+ snprintf(n, NAME_MAX, "%s/%s/device/name", sysfs, de->d_name);
|
|
|
c01703 |
f = fopen(n, "r");
|
|
|
c01703 |
}
|
|
|
c01703 |
/* non-ISA is much harder */
|
|
|
c01703 |
/* and this won't find the correct bus name if a driver
|
|
|
c01703 |
has more than one bus */
|
|
|
c01703 |
if(f == NULL) {
|
|
|
c01703 |
- sprintf(n, "%s/%s/device", sysfs, de->d_name);
|
|
|
c01703 |
+ snprintf(n, NAME_MAX, "%s/%s/device", sysfs, de->d_name);
|
|
|
c01703 |
if(!(ddir = opendir(n)))
|
|
|
c01703 |
continue;
|
|
|
c01703 |
while ((dde = readdir(ddir)) != NULL) {
|
|
|
c01703 |
@@ -240,8 +240,8 @@ struct i2c_adap *gather_i2c_busses(void)
|
|
|
c01703 |
if (!strcmp(dde->d_name, ".."))
|
|
|
c01703 |
continue;
|
|
|
c01703 |
if ((!strncmp(dde->d_name, "i2c-", 4))) {
|
|
|
c01703 |
- sprintf(n, "%s/%s/device/%s/name",
|
|
|
c01703 |
- sysfs, de->d_name, dde->d_name);
|
|
|
c01703 |
+ snprintf(n, NAME_MAX, "%s/%s/device/%s/name",
|
|
|
c01703 |
+ sysfs, de->d_name, dde->d_name);
|
|
|
c01703 |
if((f = fopen(n, "r")))
|
|
|
c01703 |
goto found;
|
|
|
c01703 |
}
|
|
|
c01703 |
--
|
|
|
c01703 |
2.14.3
|
|
|
c01703 |
|