[PATCH v2] staging: fbtft: prefer snprintf over sprintf in fbtft-core.c

[Tomasz Unger]

Using sprintf has potential for buffer overflows if the formatted
string exceeds the destination buffer size. Replace it with
snprintf, passing sizeof() of the fixed-size stack buffers
(text1[50] and text2[50]) so the write is always bounded.

An overflow is impossible here: even the worst case for the
argument types (size_t for text1, three ints for text2) still
fits within 50 bytes. Use snprintf() rather than scnprintf()
since the return value is not used here.

Signed-off-by: Tomasz Unger <tomasz.unger@xxxxxxxx>
---
Changes in v2 (per Dan Carpenter's review):
- Switched from scnprintf() to snprintf(), since the return
  value is unused.
- Reworded the commit message: overflow is impossible, not
  merely unlikely, and dropped detail about where the values
  come from.

Verified with checkpatch.pl - no errors or warnings.
Compiled the fbtft module successfully with CONFIG_FB_TFT=m.
fb.ko, syscopyarea.ko, sysimgblt.ko, sysfillrect.ko,
fb_sys_fops.ko and fbtft.ko all load without errors in a QEMU
environment (verified via insmod and lsmod, dmesg shows no
errors).
---
 drivers/staging/fbtft/fbtft-core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
index ca0c38221c16..9ea0442a337e 100644
--- a/drivers/staging/fbtft/fbtft-core.c
+++ b/drivers/staging/fbtft/fbtft-core.c
@@ -784,10 +784,10 @@ int fbtft_register_framebuffer(struct fb_info *fb_info)
 	fbtft_sysfs_init(par);
 
 	if (par->txbuf.buf && par->txbuf.len >= 1024)
-		sprintf(text1, ", %zu KiB buffer memory", par->txbuf.len >> 10);
+		snprintf(text1, sizeof(text1), ", %zu KiB buffer memory", par->txbuf.len >> 10);
 	if (spi)
-		sprintf(text2, ", spi%d.%d at %d MHz", spi->controller->bus_num,
-			spi_get_chipselect(spi, 0), spi->max_speed_hz / 1000000);
+		snprintf(text2, sizeof(text2), ", spi%d.%d at %d MHz", spi->controller->bus_num,
+			 spi_get_chipselect(spi, 0), spi->max_speed_hz / 1000000);
 	fb_dbg(fb_info,
 	       "%s frame buffer, %dx%d, %d KiB video memory%s, fps=%lu%s\n",
 	       fb_info->fix.id, fb_info->var.xres, fb_info->var.yres,

---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260820-fbtft-v2-final-7891edd1d87e

Best regards,
--  
Tomasz Unger <tomasz.unger@xxxxxxxx>