From 238ddbb98c327a7392ced5ae65216c55969749ea Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Tue, 9 Jun 2009 13:44:02 +0100 Subject: [SCSI] gdth: fix overlapping snprintf users Closes-bug: http://bugzilla.kernel.org/show_bug.cgi?id=13438 Closes-bug: http://bugzilla.kernel.org/show_bug.cgi?id=13437 Signed-off-by: Alan Cox Signed-off-by: James Bottomley --- drivers/scsi/gdth_proc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'drivers/scsi') diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c index 59349a316e1..1258da34fbc 100644 --- a/drivers/scsi/gdth_proc.c +++ b/drivers/scsi/gdth_proc.c @@ -152,6 +152,7 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length, struct Scsi_Host *host, gdth_ha_str *ha) { int size = 0,len = 0; + int hlen; off_t begin = 0,pos = 0; int id, i, j, k, sec, flag; int no_mdrv = 0, drv_no, is_mirr; @@ -192,11 +193,11 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length, if (reserve_list[0] == 0xff) strcpy(hrec, "--"); else { - sprintf(hrec, "%d", reserve_list[0]); + hlen = sprintf(hrec, "%d", reserve_list[0]); for (i = 1; i < MAX_RES_ARGS; i++) { if (reserve_list[i] == 0xff) break; - sprintf(hrec,"%s,%d", hrec, reserve_list[i]); + hlen += snprintf(hrec + hlen , 161 - hlen, ",%d", reserve_list[i]); } } size = sprintf(buffer+len, -- cgit v1.2.3