From d062793e7aebde3ffee796dfd4180716632ae444 Mon Sep 17 00:00:00 2001

From: Jean Delvare <jdelvare@suse.de>

Date: Wed, 8 Nov 2017 22:17:43 +0100

Subject: [PATCH 2/3] tools: i2cbusses: Check the return value of snprintf

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

It's very unlikely that these paths will ever be truncated, but

better safe than sorry.

Suggested by Uwe Kleine-Kц╤nig.

---

 tools/i2cbusses.c | 34 ++++++++++++++++++++++++++++------

 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/tools/i2cbusses.c b/tools/i2cbusses.c

index cb78cc7..41f5b6b 100644

--- a/tools/i2cbusses.c

+++ b/tools/i2cbusses.c

@@ -137,7 +137,7 @@ struct i2c_adap *gather_i2c_busses(void)

 	FILE *f;

 	char fstype[NAME_MAX], sysfs[NAME_MAX], n[NAME_MAX];

 	int foundsysfs = 0;

-	int count=0;

+	int len, count = 0;

 	struct i2c_adap *adapters;

 	adapters = calloc(BUNCH, sizeof(struct i2c_adap));

@@ -220,18 +220,32 @@ struct i2c_adap *gather_i2c_busses(void)

 		/* this should work for kernels 2.6.5 or higher and */

 		/* is preferred because is unambiguous */

-		snprintf(n, NAME_MAX, "%s/%s/name", sysfs, de->d_name);

+		len = snprintf(n, NAME_MAX, "%s/%s/name", sysfs, de->d_name);

+		if (len >= NAME_MAX) {

+			fprintf(stderr, "%s: path truncated\n", n);

+			continue;

+		}

 		f = fopen(n, "r");

 		/* this seems to work for ISA */

 		if(f == NULL) {

-			snprintf(n, NAME_MAX, "%s/%s/device/name", sysfs, de->d_name);

+			len = snprintf(n, NAME_MAX, "%s/%s/device/name", sysfs,

+				       de->d_name);

+			if (len >= NAME_MAX) {

+				fprintf(stderr, "%s: path truncated\n", n);

+				continue;

+			}

 			f = fopen(n, "r");

 		}

 		/* non-ISA is much harder */

 		/* and this won't find the correct bus name if a driver

 		   has more than one bus */

 		if(f == NULL) {

-			snprintf(n, NAME_MAX, "%s/%s/device", sysfs, de->d_name);

+			len = snprintf(n, NAME_MAX, "%s/%s/device", sysfs,

+				       de->d_name);

+			if (len >= NAME_MAX) {

+				fprintf(stderr, "%s: path truncated\n", n);

+				continue;

+			}

 			if(!(ddir = opendir(n)))

 				continue;

 			while ((dde = readdir(ddir)) != NULL) {

@@ -240,8 +254,16 @@ struct i2c_adap *gather_i2c_busses(void)

 				if (!strcmp(dde->d_name, ".."))

 					continue;

 				if ((!strncmp(dde->d_name, "i2c-", 4))) {

-					snprintf(n, NAME_MAX, "%s/%s/device/%s/name",

-						 sysfs, de->d_name, dde->d_name);

+					len = snprintf(n, NAME_MAX,

+						       "%s/%s/device/%s/name",

+						       sysfs, de->d_name,

+						       dde->d_name);

+					if (len >= NAME_MAX) {

+						fprintf(stderr,

+							"%s: path truncated\n",

+							n);

+						continue;

+					}

 					if((f = fopen(n, "r")))

 						goto found;

 				}

-- 

2.14.3