Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 4 Sep 2023 21:36:28 +0200
From:   Samuel Thibault <samuel.thibault@ens-lyon.org>
To:     Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc:     William Hubbs <w.d.hubbs@gmail.com>,
        Chris Brannon <chris@the-brannons.com>,
        Kirk Reiser <kirk@reisers.ca>,
        Greg Kroah-Hartman <gregkh@suse.de>,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org,
        speakup@linux-speakup.org
Subject: Re: [PATCH] accessibility: speakup: Fix incorrect string length
 computation in report_char_chartab_status()
Message-ID: <20230904193628.movlpsvxnxre6vy3@begin>
Mail-Followup-To: Samuel Thibault <samuel.thibault@ens-lyon.org>,
        Christophe JAILLET <christophe.jaillet@wanadoo.fr>,
        William Hubbs <w.d.hubbs@gmail.com>,
        Chris Brannon <chris@the-brannons.com>,
        Kirk Reiser <kirk@reisers.ca>, Greg Kroah-Hartman <gregkh@suse.de>,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org,
        speakup@linux-speakup.org
References: <b388b088485aff5dc223f2723ee61e00e5cd3f7d.1693855874.git.christophe.jaillet@wanadoo.fr>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <b388b088485aff5dc223f2723ee61e00e5cd3f7d.1693855874.git.christophe.jaillet@wanadoo.fr>
Organization: I am not organized
User-Agent: NeoMutt/20170609 (1.8.3)
Precedence: bulk

Christophe JAILLET, le lun. 04 sept. 2023 21:31:44 +0200, a ecrit:
> snprintf() returns the "number of characters which *would* be generated for
> the given input", not the size *really* generated.
> 
> In order to avoid too large values for 'len' (and potential negative
> values for "sizeof(buf) - (len - 1)") use scnprintf() instead of
> snprintf().
> 
> Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Thanks!

> ---
> I guess that the -1 in the 2nd snprintf() call is here to overwrite the
> ending \n.
> ---
>  drivers/accessibility/speakup/kobjects.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/accessibility/speakup/kobjects.c b/drivers/accessibility/speakup/kobjects.c
> index a7522d409802..1eea7c492875 100644
> --- a/drivers/accessibility/speakup/kobjects.c
> +++ b/drivers/accessibility/speakup/kobjects.c
> @@ -92,9 +92,9 @@ static void report_char_chartab_status(int reset, int received, int used,
>  	if (reset) {
>  		pr_info("%s reset to defaults\n", object_type[do_characters]);
>  	} else if (received) {
> -		len = snprintf(buf, sizeof(buf),
> -			       " updated %d of %d %s\n",
> -			       used, received, object_type[do_characters]);
> +		len = scnprintf(buf, sizeof(buf),
> +				" updated %d of %d %s\n",
> +				used, received, object_type[do_characters]);
>  		if (rejected)
>  			snprintf(buf + (len - 1), sizeof(buf) - (len - 1),
>  				 " with %d reject%s\n",
> -- 
> 2.34.1