Blame SOURCES/0002-tools-i2cbusses-Check-the-return-value-of-snprintf.patch

d3440c
From d062793e7aebde3ffee796dfd4180716632ae444 Mon Sep 17 00:00:00 2001
d3440c
From: Jean Delvare <jdelvare@suse.de>
d3440c
Date: Wed, 8 Nov 2017 22:17:43 +0100
d3440c
Subject: [PATCH 2/3] tools: i2cbusses: Check the return value of snprintf
d3440c
MIME-Version: 1.0
d3440c
Content-Type: text/plain; charset=UTF-8
d3440c
Content-Transfer-Encoding: 8bit
d3440c
d3440c
It's very unlikely that these paths will ever be truncated, but
d3440c
better safe than sorry.
d3440c
d3440c
Suggested by Uwe Kleine-König.
d3440c
---
d3440c
 tools/i2cbusses.c | 34 ++++++++++++++++++++++++++++------
d3440c
 1 file changed, 28 insertions(+), 6 deletions(-)
d3440c
d3440c
diff --git a/tools/i2cbusses.c b/tools/i2cbusses.c
d3440c
index cb78cc7..41f5b6b 100644
d3440c
--- a/tools/i2cbusses.c
d3440c
+++ b/tools/i2cbusses.c
d3440c
@@ -137,7 +137,7 @@ struct i2c_adap *gather_i2c_busses(void)
d3440c
 	FILE *f;
d3440c
 	char fstype[NAME_MAX], sysfs[NAME_MAX], n[NAME_MAX];
d3440c
 	int foundsysfs = 0;
d3440c
-	int count=0;
d3440c
+	int len, count = 0;
d3440c
 	struct i2c_adap *adapters;
d3440c
 
d3440c
 	adapters = calloc(BUNCH, sizeof(struct i2c_adap));
d3440c
@@ -220,18 +220,32 @@ struct i2c_adap *gather_i2c_busses(void)
d3440c
 
d3440c
 		/* this should work for kernels 2.6.5 or higher and */
d3440c
 		/* is preferred because is unambiguous */
d3440c
-		snprintf(n, NAME_MAX, "%s/%s/name", sysfs, de->d_name);
d3440c
+		len = snprintf(n, NAME_MAX, "%s/%s/name", sysfs, de->d_name);
d3440c
+		if (len >= NAME_MAX) {
d3440c
+			fprintf(stderr, "%s: path truncated\n", n);
d3440c
+			continue;
d3440c
+		}
d3440c
 		f = fopen(n, "r");
d3440c
 		/* this seems to work for ISA */
d3440c
 		if(f == NULL) {
d3440c
-			snprintf(n, NAME_MAX, "%s/%s/device/name", sysfs, de->d_name);
d3440c
+			len = snprintf(n, NAME_MAX, "%s/%s/device/name", sysfs,
d3440c
+				       de->d_name);
d3440c
+			if (len >= NAME_MAX) {
d3440c
+				fprintf(stderr, "%s: path truncated\n", n);
d3440c
+				continue;
d3440c
+			}
d3440c
 			f = fopen(n, "r");
d3440c
 		}
d3440c
 		/* non-ISA is much harder */
d3440c
 		/* and this won't find the correct bus name if a driver
d3440c
 		   has more than one bus */
d3440c
 		if(f == NULL) {
d3440c
-			snprintf(n, NAME_MAX, "%s/%s/device", sysfs, de->d_name);
d3440c
+			len = snprintf(n, NAME_MAX, "%s/%s/device", sysfs,
d3440c
+				       de->d_name);
d3440c
+			if (len >= NAME_MAX) {
d3440c
+				fprintf(stderr, "%s: path truncated\n", n);
d3440c
+				continue;
d3440c
+			}
d3440c
 			if(!(ddir = opendir(n)))
d3440c
 				continue;
d3440c
 			while ((dde = readdir(ddir)) != NULL) {
d3440c
@@ -240,8 +254,16 @@ struct i2c_adap *gather_i2c_busses(void)
d3440c
 				if (!strcmp(dde->d_name, ".."))
d3440c
 					continue;
d3440c
 				if ((!strncmp(dde->d_name, "i2c-", 4))) {
d3440c
-					snprintf(n, NAME_MAX, "%s/%s/device/%s/name",
d3440c
-						 sysfs, de->d_name, dde->d_name);
d3440c
+					len = snprintf(n, NAME_MAX,
d3440c
+						       "%s/%s/device/%s/name",
d3440c
+						       sysfs, de->d_name,
d3440c
+						       dde->d_name);
d3440c
+					if (len >= NAME_MAX) {
d3440c
+						fprintf(stderr,
d3440c
+							"%s: path truncated\n",
d3440c
+							n);
d3440c
+						continue;
d3440c
+					}
d3440c
 					if((f = fopen(n, "r")))
d3440c
 						goto found;
d3440c
 				}
d3440c
-- 
d3440c
2.14.3
d3440c