iio:imu: adis16480: show_firmware() buffer too small

Smatch complains that snprintf() returns the number of characters, not counting the NUL terminator, which *would* have been printed if there were enough space. In other words the return value could be more than sizeof(buf). In this case, we are printing something like "ff.ff\n" which is at most 6 characters and a NUL so that's not an issue. I changed snprintf() to scnprintf() to silence the warning. But since the buffer doesn't include space for the NUL terminator, we need to make it bigger or the "\n" will be truncated off. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-By: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jonathan Cameron <jic23@kernel.org>

iio:imu: adis16480: show_firmware() buffer too small
Smatch complains that snprintf() returns the number of characters, not counting the NUL terminator, which *would* have been printed if there were enough space. In other words the return value could be more than sizeof(buf). In this case, we are printing something like "ff.ff\n" which is at most 6 characters and a NUL so that's not an issue. I changed snprintf() to scnprintf() to silence the warning. But since the buffer doesn't include space for the NUL terminator, we need to make it bigger or the "\n" will be truncated off. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-By: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Dan Carpenter · Jonathan Cameron
1 parent 12660138b4
Showing 1 changed file with 2 additions and 2 deletions Side-by-side Diff
drivers/iio/imu/adis16480.c
@@ -125,7 +125,7 @@
 		char __user *userbuf, size_t count, loff_t *ppos)
 {
 	struct adis16480 *adis16480 = file->private_data;
-	char buf[6];
+	char buf[7];
 	size_t len;
 	u16 rev;
 	int ret;
@@ -134,7 +134,7 @@
 	if (ret < 0)
 		return ret;
  
-	len = snprintf(buf, sizeof(buf), "%x.%x\n", rev >> 8, rev & 0xff);
+	len = scnprintf(buf, sizeof(buf), "%x.%x\n", rev >> 8, rev & 0xff);
  
 	return simple_read_from_buffer(userbuf, count, ppos, buf, len);
 }
...	...	@@ -125,7 +125,7 @@
125	125	char __user userbuf, size_t count, loff_t ppos)
126	126	{
127	127	struct adis16480 *adis16480 = file->private_data;
128		- char buf[6];
	128	+ char buf[7];
129	129	size_t len;
130	130	u16 rev;
131	131	int ret;
...	...	@@ -134,7 +134,7 @@
134	134	if (ret < 0)
135	135	return ret;
136	136
137		- len = snprintf(buf, sizeof(buf), "%x.%x\n", rev >> 8, rev & 0xff);
	137	+ len = scnprintf(buf, sizeof(buf), "%x.%x\n", rev >> 8, rev & 0xff);
138	138
139	139	return simple_read_from_buffer(userbuf, count, ppos, buf, len);
140	140	}