From 5bde583d13efe2592803e3bffaf5462b05003c72 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Wed, 8 Apr 2026 15:35:13 +0800 Subject: [PATCH] um: mconsole: use bounded version string formatting mconsole_version() formats several UTS strings into a fixed 256-byte local buffer with sprintf() and no length bound. Use snprintf() so the version reply stays within the local buffer. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260408160001.1-um-mconsole-v2-pengpeng@iscas.ac.cn Signed-off-by: Johannes Berg --- arch/um/drivers/mconsole_kern.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c index e2a9e8879f58..18d0ec15557c 100644 --- a/arch/um/drivers/mconsole_kern.c +++ b/arch/um/drivers/mconsole_kern.c @@ -106,9 +106,9 @@ void mconsole_version(struct mc_request *req) { char version[256]; - sprintf(version, "%s %s %s %s %s", utsname()->sysname, - utsname()->nodename, utsname()->release, utsname()->version, - utsname()->machine); + snprintf(version, sizeof(version), "%s %s %s %s %s", + utsname()->sysname, utsname()->nodename, utsname()->release, + utsname()->version, utsname()->machine); mconsole_reply(req, version, 0, 0); }