dell_rbu: use scnprintf() instead of less secure sprintf()

commit 81156928f8fe31621e467490b9d441c0285998c3 upstream.

Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or
/sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an
oops.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index 13946ebd77d6dbfb904eeec75f647a4ceabdf057..b4704e150b284cd6347e30585759aeae1fc3af63 100644 (file)
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struct kobject *kobj,
 {
        int size = 0;
        if (!pos)
-               size = sprintf(buffer, "%s\n", image_type);
+               size = scnprintf(buffer, count, "%s\n", image_type);
        return size;
 }
 
@@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj,
        int size = 0;
        if (!pos) {
                spin_lock(&rbu_data.lock);
-               size = sprintf(buffer, "%lu\n", rbu_data.packetsize);
+               size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize);
                spin_unlock(&rbu_data.lock);
        }
        return size;