On Thu, Nov 14, 2024 at 06:34:49PM +0900, Vincent Mailhol wrote:
Hi Dan,
On 14/11/2024 at 18:03, Dan Carpenter wrote:
This code is printing hex values to the &local_txbuf buffer and it's
using the snprintf() function to try prevent buffer overflows. The
problem is that it's not passing the correct limit to the snprintf()
function so the limit doesn't do anything. On each iteration we print
two digits so the remaining size should also decrease by two, but
instead it passes the sizeof() the entire buffer each time.
If the frame->len were too long it would result in a buffer overflow.
But, can frame->len be too long? Classical CAN frame maximum length is 8
bytes. And I do not see a path for a malformed frame to reach this part of
the driver.
If such a path exists, I think this should be explained. Else, I am just not
sure if this needs a Fixes: tag.
Even when bugs don't affect runtime we still assign a Fixes tag, but we don't
CC stable. There is no way that passing the wrong size was intentional.