diff options
| author | rgduran <randy.g.duran@intel.com> | 2016-11-03 16:53:40 -0700 |
|---|---|---|
| committer | Mohammed Habibulla <moch@google.com> | 2016-11-15 14:29:14 -0800 |
| commit | 8c9320c67d8ab039b35fc604aa1324aaf205f738 (patch) | |
| tree | f388311ac8e2161328762f1ea69f0195880023e5 | |
| parent | 218e71538627504b6df3a2be27f3ff82bbc9b135 (diff) | |
| download | broxton-v4.4-8c9320c67d8ab039b35fc604aa1324aaf205f738.tar.gz | |
gpio: gpiolib-acpi: static analysis bug possible OOB array using sprinf
change sprintf to snprintf and check on return for possible OOB.
exit function with no mem error.
BUG: 32795727
Change-Id: Iebc5665a496901aa0fd26919e82d876558e59e63
Signed-off-by: rgduran <randy.g.duran@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
| -rw-r--r-- | drivers/gpio/gpiolib-acpi.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c index 4cfceab3121d..e1dfab05d0da 100644 --- a/drivers/gpio/gpiolib-acpi.c +++ b/drivers/gpio/gpiolib-acpi.c @@ -175,7 +175,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares, irq_handler_t handler = NULL; struct gpio_desc *desc; unsigned long irqflags; - int ret, pin, irq; + int ret, pin, irq, ret_error; if (ares->type != ACPI_RESOURCE_TYPE_GPIO) return AE_OK; @@ -189,9 +189,13 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares, if (pin <= 255) { char ev_name[5]; - sprintf(ev_name, "_%c%02X", + if (snprintf(ev_name, sizeof(ev_name), "_%c%02X", agpio->triggering == ACPI_EDGE_SENSITIVE ? 'E' : 'L', - pin); + pin) >= sizeof(ev_name)) { + ret_error = -ENOMEM; + goto exit_func; + } + if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle))) handler = acpi_gpio_irq_handler; } @@ -273,8 +277,9 @@ fail_unlock_irq: gpiochip_unlock_as_irq(chip, pin); fail_free_desc: gpiochip_free_own_desc(desc); - return AE_ERROR; +exit_func: + return ret_error; } /** |