diff options
| author | Rasmus Villemoes <linux@rasmusvillemoes.dk> | 2015-02-12 15:01:39 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-04-18 07:55:48 +0200 |
| commit | 6e447a7267d091190b1593c06fe5eebd2cce3e7e (patch) | |
| tree | 478830893347a88bec758f5b9fa3b14bbb7b58cd /lib | |
| parent | 89de640c106731a830ac52566b39d0d417f2817d (diff) | |
| download | linux-stable-6e447a7267d091190b1593c06fe5eebd2cce3e7e.tar.gz linux-stable-6e447a7267d091190b1593c06fe5eebd2cce3e7e.tar.bz2 linux-stable-6e447a7267d091190b1593c06fe5eebd2cce3e7e.zip | |
lib/vsprintf.c: improve sanity check in vsnprintf()
commit 2aa2f9e21e4eb25c720b2e7d80f8929638f6ad73 upstream.
On 64 bit, size may very well be huge even if bit 31 happens to be 0.
Somehow it doesn't feel right that one can pass a 5 GiB buffer but not a
3 GiB one. So cap at INT_MAX as was probably the intention all along.
This is also the made-up value passed by sprintf and vsprintf.
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/vsprintf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/vsprintf.c b/lib/vsprintf.c index ec337f64f52d..3146abf4efc3 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -1728,7 +1728,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) /* Reject out-of-range values early. Large positive sizes are used for unknown buffer sizes. */ - if (WARN_ON_ONCE((int) size < 0)) + if (WARN_ON_ONCE(size > INT_MAX)) return 0; str = buf; |