Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix off-by-one when calling snprintf(9) in hdafg_getdev() 

This is actually harmless, since:
- the offset is too short rather than too long (no overflow)
- the struct audio_device comes from userland (no information leak)

"looks good to me" nat@
This commit is contained in:
khorben 2018-01-04 00:09:12 +00:00
parent 9b24abb72f
commit db8ce746e1
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/dev/hdaudio/hdafg.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: hdafg.c,v 1.13 2017/08/04 00:25:23 mrg Exp $ */
/* $NetBSD: hdafg.c,v 1.14 2018/01/04 00:09:12 khorben Exp $ */
/*
* Copyright (c) 2009 Precedence Technologies Ltd <support@precedence.co.uk>
@ -60,7 +60,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: hdafg.c,v 1.13 2017/08/04 00:25:23 mrg Exp $");
__KERNEL_RCSID(0, "$NetBSD: hdafg.c,v 1.14 2018/01/04 00:09:12 khorben Exp $");
#include <sys/types.h>
#include <sys/param.h>
@ -4058,7 +4058,7 @@ hdafg_getdev(void *opaque, struct audio_device *audiodev)
sc->sc_vendor);
hdaudio_findproduct(audiodev->version, sizeof(audiodev->version),
sc->sc_vendor, sc->sc_product);
snprintf(audiodev->config, sizeof(audiodev->config) - 1,
snprintf(audiodev->config, sizeof(audiodev->config),
"%02Xh", sc->sc_nid);
return 0;