diff options
| author | Josephine Pfeiffer <hi@josie.lol> | 2025-10-01 21:14:04 +0200 |
|---|---|---|
| committer | Heiko Carstens <hca@linux.ibm.com> | 2025-10-21 10:17:29 +0200 |
| commit | 5379879a76e25998d56c2136fef7d67eae33418f (patch) | |
| tree | 60e3004e82dfca1a3beac610dd60f188907c1bf3 | |
| parent | dd7d1d34ae484ba2caed8e01e03bdc4c263b1442 (diff) | |
| download | linux-5379879a76e25998d56c2136fef7d67eae33418f.tar.gz linux-5379879a76e25998d56c2136fef7d67eae33418f.zip | |
s390/extmem: Replace sprintf() with snprintf() for buffer safety
Replace unsafe sprintf() calls with snprintf() in segment_save() to
prevent potential buffer overflows. The function builds command strings
by repeatedly appending to a fixed-size buffer, which could overflow if
segment ranges are numerous or values are large.
Signed-off-by: Josephine Pfeiffer <hi@josie.lol>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
| -rw-r--r-- | arch/s390/mm/extmem.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c index f7da53e212f5..b6464a322eb1 100644 --- a/arch/s390/mm/extmem.c +++ b/arch/s390/mm/extmem.c @@ -598,14 +598,16 @@ segment_save(char *name) goto out; } - sprintf(cmd1, "DEFSEG %s", name); + snprintf(cmd1, sizeof(cmd1), "DEFSEG %s", name); for (i=0; i<seg->segcnt; i++) { - sprintf(cmd1+strlen(cmd1), " %lX-%lX %s", - seg->range[i].start >> PAGE_SHIFT, - seg->range[i].end >> PAGE_SHIFT, - segtype_string[seg->range[i].start & 0xff]); + size_t len = strlen(cmd1); + + snprintf(cmd1 + len, sizeof(cmd1) - len, " %lX-%lX %s", + seg->range[i].start >> PAGE_SHIFT, + seg->range[i].end >> PAGE_SHIFT, + segtype_string[seg->range[i].start & 0xff]); } - sprintf(cmd2, "SAVESEG %s", name); + snprintf(cmd2, sizeof(cmd2), "SAVESEG %s", name); response = 0; cpcmd(cmd1, NULL, 0, &response); if (response) { |