Commit 45e0b4b3 authored by Arnd Bergmann's avatar Arnd Bergmann Committed by David S. Miller
Browse files

isdn: divert: fix sprintf buffer overflow warning

One string we pass into the cs->info buffer might be too long,
as pointed out by gcc:

drivers/isdn/divert/isdn_divert.c: In function 'll_callback':
drivers/isdn/divert/isdn_divert.c:488:22: error: '%d' directive writing between 1 and 3 bytes into a region of size between 1 and 69 [-Werror=format-overflow=]
 sprintf(cs->info, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n",
drivers/isdn/divert/isdn_divert.c:488:22: note: directive argument in the range [0, 255]
drivers/isdn/divert/isdn_divert.c:488:4: note: 'sprintf' output 25 or more bytes (assuming 129) into a destination of size 90

This is unlikely to actually cause problems, so let's use snprintf
as a simple workaround to shut  up the warning and truncate the
buffer instead.
Signed-off-by: default avatarArnd Bergmann <>
Signed-off-by: default avatarDavid S. Miller <>
parent c98b0537
...@@ -485,18 +485,19 @@ static int isdn_divert_icall(isdn_ctrl *ic) ...@@ -485,18 +485,19 @@ static int isdn_divert_icall(isdn_ctrl *ic)
cs->deflect_dest[0] = '\0'; cs->deflect_dest[0] = '\0';
retval = 4; /* only proceed */ retval = 4; /* only proceed */
} }
sprintf(cs->info, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n", snprintf(cs->info, sizeof(cs->info),
cs->akt_state, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n",
cs->divert_id, cs->akt_state,
divert_if.drv_to_name(cs->ics.driver), cs->divert_id,
(ic->command == ISDN_STAT_ICALLW) ? "1" : "0", divert_if.drv_to_name(cs->ics.driver),
cs->, (ic->command == ISDN_STAT_ICALLW) ? "1" : "0",
cs->ics.parm.setup.eazmsn, cs->,
cs->ics.parm.setup.si1, cs->ics.parm.setup.eazmsn,
cs->ics.parm.setup.si2, cs->ics.parm.setup.si1,
cs->ics.parm.setup.screen, cs->ics.parm.setup.si2,
dv->rule.waittime, cs->ics.parm.setup.screen,
cs->deflect_dest); dv->rule.waittime,
if ((dv->rule.action == DEFLECT_REPORT) || if ((dv->rule.action == DEFLECT_REPORT) ||
(dv->rule.action == DEFLECT_REJECT)) { (dv->rule.action == DEFLECT_REJECT)) {
put_info_buffer(cs->info); put_info_buffer(cs->info);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment