drm/msm: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>

diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 7fd29829b2fad47f066d6e6fd250fa4f9b75e4e7..1d5c43c222690eaec09989c5bbe4a6b42afec663 100644 (file)
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -673,7 +673,7 @@ static char *adreno_gpu_ascii85_encode(u32 *src, size_t len)
                return NULL;
 
        for (i = 0; i < l; i++)
-               buf_itr += snprintf(buf + buf_itr, buffer_size - buf_itr, "%s",
+               buf_itr += scnprintf(buf + buf_itr, buffer_size - buf_itr, "%s",
                                ascii85_encode(src[i], out));
 
        return buf;