diff mbox series

[BlueZ,v1] mcp: replace sprintf() with snprintf() in cb_track_duration()

Message ID 20240628123647.547516-1-r.smirnov@omp.ru
State New
Headers show
Series [BlueZ,v1] mcp: replace sprintf() with snprintf() in cb_track_duration() | expand

Commit Message

Roman Smirnov June 28, 2024, 12:36 p.m. UTC 
Use snprintf() instead of sprintf() to avoid buffer overflow.

Found with the SVACE static analysis tool
---
 profiles/audio/mcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

patchwork-bot+bluetooth@kernel.org June 28, 2024, 3:10 p.m. UTC | #1 
Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 28 Jun 2024 15:36:46 +0300 you wrote:
> Use snprintf() instead of sprintf() to avoid buffer overflow.
> 
> Found with the SVACE static analysis tool
> ---
>  profiles/audio/mcp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Here is the summary with links:
  - [BlueZ,v1] mcp: replace sprintf() with snprintf() in cb_track_duration()
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=9886a7557b3c

You are awesome, thank you!
diff mbox series

Patch

diff --git a/profiles/audio/mcp.c b/profiles/audio/mcp.c
index 8d1b7588e..0a2991f20 100644
--- a/profiles/audio/mcp.c
+++ b/profiles/audio/mcp.c
@@ -169,7 +169,7 @@  static void cb_track_duration(struct bt_mcp *mcp, int32_t duration)
 	unsigned char buf[10];
 
 	/* MCP defines duration is int32 but api takes it as uint32 */
-	sprintf((char *)buf, "%d", duration);
+	snprintf((char *)buf, 10, "%d", duration);
 	media_player_set_metadata(mp, NULL, "Duration", buf, sizeof(buf));
 	media_player_metadata_changed(mp);
 }