ASoC: SOF: debug: Fix potential buffer overflow by snprintf()

commit 1eb123ce985e6cf302ac6e3f19862d132d86fa8f upstream.

snprintf() returns the would-be-filled size when the string overflows
the given buffer size, hence using this value may result in the buffer
overflow (although it's unrealistic).

This patch replaces with a safer version, scnprintf() for papering
over such a potential issue.

Fixes: 5b10b6298921 ("ASoC: SOF: Add `memory_info` file to debugfs")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20220801165420.25978-3-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c
index a51a928ea40a7388ceafef518ed7b48f5fc35918..5f780ef9581a90a293d94f3a612cbcd10ee85647 100644 (file)
--- a/sound/soc/sof/debug.c
+++ b/sound/soc/sof/debug.c
@@ -668,9 +668,9 @@ static int memory_info_update(struct snd_sof_dev *sdev, char *buf, size_t buff_s
        }
 
        for (i = 0, len = 0; i < reply->num_elems; i++) {
-               ret = snprintf(buf + len, buff_size - len, "zone %d.%d used %#8x free %#8x\n",
-                              reply->elems[i].zone, reply->elems[i].id,
-                              reply->elems[i].used, reply->elems[i].free);
+               ret = scnprintf(buf + len, buff_size - len, "zone %d.%d used %#8x free %#8x\n",
+                               reply->elems[i].zone, reply->elems[i].id,
+                               reply->elems[i].used, reply->elems[i].free);
                if (ret < 0)
                        goto error;
                len += ret;