From bcdc0267c6daa002a3d33f987e86b787d11cdc4b Mon Sep 17 00:00:00 2001 From: Stefano Ceccherini Date: Fri, 3 Oct 2008 06:25:28 +0000 Subject: [PATCH] removed useless sprintf() call, added a TODO git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@27845 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/add-ons/kernel/bus_managers/acpi/acpi_ns_dump.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/add-ons/kernel/bus_managers/acpi/acpi_ns_dump.c b/src/add-ons/kernel/bus_managers/acpi/acpi_ns_dump.c index d436254fa3..4fe6de3f55 100644 --- a/src/add-ons/kernel/bus_managers/acpi/acpi_ns_dump.c +++ b/src/add-ons/kernel/bus_managers/acpi/acpi_ns_dump.c @@ -20,7 +20,8 @@ typedef struct acpi_ns_device_info { static void -dump_acpi_namespace(acpi_ns_device_info *device, char *root, void *buf, size_t* num_bytes, int indenting) { +dump_acpi_namespace(acpi_ns_device_info *device, char *root, void *buf, size_t* num_bytes, int indenting) +{ char result[255]; char output[255]; char tabs[255]; @@ -89,8 +90,9 @@ dump_acpi_namespace(acpi_ns_device_info *device, char *root, void *buf, size_t* sprintf(output, "%s BUFFER_FIELD", output); break; } - sprintf(output, "%s\n", output); - + // TODO: This is obviously broken! + // We should respect "*num_bytes", otherwise + // we could have a buffer overflow. See ticket #2786 sprintf((buf + *num_bytes), "%s", output); *num_bytes += strlen(output);