thermal: core: prevent potential string overflow

The dev->id value comes from ida_alloc() so it's a number between zero
and INT_MAX.  If it's too high then these sprintf()s will overflow.

Fixes: 203d3d4aa482 ("the generic thermal sysfs driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 45d0aa0b69b79c0fd21ba4643280e3dd7da19deb..61f0b5a3b00c4c826cd386a4db98790c026b4d60 100644 (file)
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -681,7 +681,8 @@ int thermal_bind_cdev_to_trip(struct thermal_zone_device *tz,
        if (result)
                goto release_ida;
 
-       sprintf(dev->attr_name, "cdev%d_trip_point", dev->id);
+       snprintf(dev->attr_name, sizeof(dev->attr_name), "cdev%d_trip_point",
+                dev->id);
        sysfs_attr_init(&dev->attr.attr);
        dev->attr.attr.name = dev->attr_name;
        dev->attr.attr.mode = 0444;
@@ -690,7 +691,8 @@ int thermal_bind_cdev_to_trip(struct thermal_zone_device *tz,
        if (result)
                goto remove_symbol_link;
 
-       sprintf(dev->weight_attr_name, "cdev%d_weight", dev->id);
+       snprintf(dev->weight_attr_name, sizeof(dev->weight_attr_name),
+                "cdev%d_weight", dev->id);
        sysfs_attr_init(&dev->weight_attr.attr);
        dev->weight_attr.attr.name = dev->weight_attr_name;
        dev->weight_attr.attr.mode = S_IWUSR | S_IRUGO;