[nuttx] branch master updated: drivers/ptmx: Fix a potential buffer overflow

[pkarashchenko]

This is an automated email from the ASF dual-hosted git repository.

pkarashchenko pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new d8a61108cf drivers/ptmx: Fix a potential buffer overflow
d8a61108cf is described below

commit d8a61108cfe51f821afe6b9754159d1d7e7e139a
Author: Huang Qi <huang...@xiaomi.com>
AuthorDate: Fri Jun 9 21:10:44 2023 +0800

    drivers/ptmx: Fix a potential buffer overflow
    
    Fix warning:
    ```
    serial/ptmx.c:205:34: warning: ‘%d’ directive output may be truncated 
writing between 1 and 10 bytes into a region of size 8 [-Wformat-truncation=]
      205 |   snprintf(devname, 16, "/dev/pty%d", minor);
          |
    serial/ptmx.c:205:25: note: directive argument in the range [0, 2147483647]
      205 |   snprintf(devname, 16, "/dev/pty%d", minor);
          |                         ^~~~~~~~~~~~
    serial/ptmx.c:205:3: note: ‘snprintf’ output between 10 and 19 bytes into a 
destination of size 16
      205 |   snprintf(devname, 16, "/dev/pty%d", minor);
    ```
    
    Signed-off-by: Huang Qi <huang...@xiaomi.com>
---
 drivers/serial/ptmx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/serial/ptmx.c b/drivers/serial/ptmx.c
index 6af2e7c56b..2e0f273e6a 100644
--- a/drivers/serial/ptmx.c
+++ b/drivers/serial/ptmx.c
@@ -165,7 +165,7 @@ static int ptmx_minor_allocate(void)
 static int ptmx_open(FAR struct file *filep)
 {
   struct file temp;
-  char devname[16];
+  char devname[32];
   int minor;
   int ret;
 
@@ -202,7 +202,7 @@ static int ptmx_open(FAR struct file *filep)
 
   /* Open the master device:  /dev/ptyN, where N=minor */
 
-  snprintf(devname, 16, "/dev/pty%d", minor);
+  snprintf(devname, sizeof(devname), "/dev/pty%d", minor);
   memcpy(&temp, filep, sizeof(temp));
   ret = file_open(filep, devname, O_RDWR);
   DEBUGASSERT(ret >= 0);  /* file_open() should never fail */