From d062793e7aebde3ffee796dfd4180716632ae444 Mon Sep 17 00:00:00 2001 From: Jean Delvare Date: Wed, 8 Nov 2017 22:17:43 +0100 Subject: [PATCH 2/3] tools: i2cbusses: Check the return value of snprintf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's very unlikely that these paths will ever be truncated, but better safe than sorry. Suggested by Uwe Kleine-König. --- tools/i2cbusses.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/tools/i2cbusses.c b/tools/i2cbusses.c index cb78cc7..41f5b6b 100644 --- a/tools/i2cbusses.c +++ b/tools/i2cbusses.c @@ -137,7 +137,7 @@ struct i2c_adap *gather_i2c_busses(void) FILE *f; char fstype[NAME_MAX], sysfs[NAME_MAX], n[NAME_MAX]; int foundsysfs = 0; - int count=0; + int len, count = 0; struct i2c_adap *adapters; adapters = calloc(BUNCH, sizeof(struct i2c_adap)); @@ -220,18 +220,32 @@ struct i2c_adap *gather_i2c_busses(void) /* this should work for kernels 2.6.5 or higher and */ /* is preferred because is unambiguous */ - snprintf(n, NAME_MAX, "%s/%s/name", sysfs, de->d_name); + len = snprintf(n, NAME_MAX, "%s/%s/name", sysfs, de->d_name); + if (len >= NAME_MAX) { + fprintf(stderr, "%s: path truncated\n", n); + continue; + } f = fopen(n, "r"); /* this seems to work for ISA */ if(f == NULL) { - snprintf(n, NAME_MAX, "%s/%s/device/name", sysfs, de->d_name); + len = snprintf(n, NAME_MAX, "%s/%s/device/name", sysfs, + de->d_name); + if (len >= NAME_MAX) { + fprintf(stderr, "%s: path truncated\n", n); + continue; + } f = fopen(n, "r"); } /* non-ISA is much harder */ /* and this won't find the correct bus name if a driver has more than one bus */ if(f == NULL) { - snprintf(n, NAME_MAX, "%s/%s/device", sysfs, de->d_name); + len = snprintf(n, NAME_MAX, "%s/%s/device", sysfs, + de->d_name); + if (len >= NAME_MAX) { + fprintf(stderr, "%s: path truncated\n", n); + continue; + } if(!(ddir = opendir(n))) continue; while ((dde = readdir(ddir)) != NULL) { @@ -240,8 +254,16 @@ struct i2c_adap *gather_i2c_busses(void) if (!strcmp(dde->d_name, "..")) continue; if ((!strncmp(dde->d_name, "i2c-", 4))) { - snprintf(n, NAME_MAX, "%s/%s/device/%s/name", - sysfs, de->d_name, dde->d_name); + len = snprintf(n, NAME_MAX, + "%s/%s/device/%s/name", + sysfs, de->d_name, + dde->d_name); + if (len >= NAME_MAX) { + fprintf(stderr, + "%s: path truncated\n", + n); + continue; + } if((f = fopen(n, "r"))) goto found; } -- 2.14.3