diff options
| author | Elaine Wang <elaine.wang@intel.com> | 2014-04-09 02:04:53 +0800 |
|---|---|---|
| committer | Patrick Tjin <pattjin@google.com> | 2014-07-21 22:05:30 -0700 |
| commit | 07399050725e781899bc541c1a503b56aa55b8e9 (patch) | |
| tree | 2070737db50dc1ed3104f8ceeeef1d3b6f283b25 | |
| parent | d1553599089a69df838154ed769c3fd4456b33b7 (diff) | |
| download | libdrm-07399050725e781899bc541c1a503b56aa55b8e9.tar.gz | |
Fix klocwork issues
BZ: 185330
Use snprintf instead of sprintf while assemble strings.
Fixed a possible array index out of bounds issue.
Change-Id: Ic5d25f70f88e81209aecfe16fce9dca7af3b1bd0
Signed-off-by: Elaine Wang <elaine.wang@intel.com>
| -rw-r--r-- | libdrm/xf86drm.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libdrm/xf86drm.c b/libdrm/xf86drm.c index 26dd812..eaa7e51 100644 --- a/libdrm/xf86drm.c +++ b/libdrm/xf86drm.c @@ -322,7 +322,7 @@ static int drmOpenDevice(long dev, int minor, int type) uid_t user = DRM_DEV_UID; gid_t group = DRM_DEV_GID, serv_group; - sprintf(buf, type ? DRM_DEV_NAME : DRM_CONTROL_DEV_NAME, DRM_DIR_NAME, minor); + snprintf(buf, sizeof(buf), type ? DRM_DEV_NAME : DRM_CONTROL_DEV_NAME, DRM_DIR_NAME, minor); drmMsg("drmOpenDevice: node name is %s\n", buf); if (drm_server_info) { @@ -428,8 +428,8 @@ static int drmOpenMinor(int minor, int create, int type) if (create) return drmOpenDevice(makedev(DRM_MAJOR, minor), minor, type); - - sprintf(buf, type ? DRM_DEV_NAME : DRM_CONTROL_DEV_NAME, DRM_DIR_NAME, minor); + + snprintf(buf, sizeof(buf), type ? DRM_DEV_NAME : DRM_CONTROL_DEV_NAME, DRM_DIR_NAME, minor); if ((fd = open(buf, O_RDWR, 0)) >= 0) return fd; return -errno; @@ -583,11 +583,11 @@ static int drmOpenByName(const char *name) char *driver, *pt, *devstring; int retcode; - sprintf(proc_name, "/proc/dri/%d/name", i); + snprintf(proc_name, sizeof(proc_name), "/proc/dri/%d/name", i); if ((fd = open(proc_name, 0, 0)) >= 0) { retcode = read(fd, buf, sizeof(buf)-1); close(fd); - if (retcode) { + if (retcode > 0) { buf[retcode-1] = '\0'; for (driver = pt = buf; *pt && *pt != ' '; ++pt) ; |