From eaf74a06f13aa0e4e7e2024cb6db2ccedd3d32e3 Mon Sep 17 00:00:00 2001 From: Bradley Grove Date: Thu, 29 Aug 2013 15:55:42 -0400 Subject: [PATCH] [SCSI] esas2r: smatch - Fix overrun due to sprintf appending NULL Reported-by: Dan Carpenter Signed-off-by: Bradley Grove Signed-off-by: James Bottomley --- drivers/scsi/esas2r/esas2r_vda.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/esas2r/esas2r_vda.c b/drivers/scsi/esas2r/esas2r_vda.c index f8ec6d636846..fd1392879647 100644 --- a/drivers/scsi/esas2r/esas2r_vda.c +++ b/drivers/scsi/esas2r/esas2r_vda.c @@ -302,6 +302,7 @@ static void esas2r_complete_vda_ioctl(struct esas2r_adapter *a, if (vi->cmd.cfg.cfg_func == VDA_CFG_GET_INIT) { struct atto_ioctl_vda_cfg_cmd *cfg = &vi->cmd.cfg; struct atto_vda_cfg_rsp *rsp = &rq->func_rsp.cfg_rsp; + char buf[sizeof(cfg->data.init.fw_release) + 1]; cfg->data_length = cpu_to_le32(sizeof(struct atto_vda_cfg_init)); @@ -309,11 +310,13 @@ static void esas2r_complete_vda_ioctl(struct esas2r_adapter *a, le32_to_cpu(rsp->vda_version); cfg->data.init.fw_build = rsp->fw_build; - sprintf((char *)&cfg->data.init.fw_release, - "%1d.%02d", + snprintf(buf, sizeof(buf), "%1d.%02d", (int)LOBYTE(le16_to_cpu(rsp->fw_release)), (int)HIBYTE(le16_to_cpu(rsp->fw_release))); + memcpy(&cfg->data.init.fw_release, buf, + sizeof(cfg->data.init.fw_release)); + if (LOWORD(LOBYTE(cfg->data.init.fw_build)) == 'A') cfg->data.init.fw_version = cfg->data.init.fw_build; -- 2.34.1