From 77f06cf2aecbcdc5d1d7bfe864e9acb436516a7e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= Date: Tue, 21 Jan 2025 18:33:31 +0100 Subject: [PATCH] pch_thermal: use user_memcpy() to write in a user buffer Change-Id: I8eccde638ba30051fcec375b7d616e1d1bddf5ed Reviewed-on: https://review.haiku-os.org/c/haiku/+/8854 Reviewed-by: waddlesplash Tested-by: Commit checker robot --- .../drivers/power/pch_thermal/pch_thermal.cpp | 29 ++++++++++++------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/src/add-ons/kernel/drivers/power/pch_thermal/pch_thermal.cpp b/src/add-ons/kernel/drivers/power/pch_thermal/pch_thermal.cpp index 5fe17d5217..953e0acb9d 100644 --- a/src/add-ons/kernel/drivers/power/pch_thermal/pch_thermal.cpp +++ b/src/add-ons/kernel/drivers/power/pch_thermal/pch_thermal.cpp @@ -94,29 +94,38 @@ pch_thermal_read(void* _cookie, off_t position, void *buf, size_t* num_bytes) return B_IO_ERROR; if (position == 0) { - size_t max_len = *num_bytes; - char *str = (char *)buf; + char buffer[1024]; + size_t maxLength = sizeof(buffer); + size_t totalCopied = 0; + char *str = (char *)buffer; TRACE("pch_thermal: read()\n"); pch_thermal_control(device, drvOpGetThermalType, &therm_info, 0); - snprintf(str, max_len, " Critical Temperature: %" B_PRIu32 ".%" + int32 copied = snprintf(str, maxLength, " Critical Temperature: %" B_PRIu32 ".%" B_PRIu32 " C\n", (therm_info.critical_temp / 10), (therm_info.critical_temp % 10)); - max_len -= strlen(str); - str += strlen(str); - snprintf(str, max_len, " Current Temperature: %" B_PRIu32 ".%" + maxLength -= copied; + str += copied; + totalCopied += copied; + copied = snprintf(str, maxLength, " Current Temperature: %" B_PRIu32 ".%" B_PRIu32 " C\n", (therm_info.current_temp / 10), (therm_info.current_temp % 10)); if (therm_info.hot_temp > 0) { - max_len -= strlen(str); - str += strlen(str); - snprintf(str, max_len, " Hot Temperature: %" B_PRIu32 ".%" + maxLength -= copied; + str += copied; + totalCopied += copied; + copied = snprintf(str, maxLength, " Hot Temperature: %" B_PRIu32 ".%" B_PRIu32 " C\n", (therm_info.hot_temp / 10), (therm_info.hot_temp % 10)); } - *num_bytes = strlen((char *)buf); + + totalCopied += copied; + totalCopied = min_c(*num_bytes, totalCopied + 1); + if (user_memcpy((char*)buf, buffer, totalCopied) != B_OK) + return B_BAD_ADDRESS; + *num_bytes = totalCopied; } else { *num_bytes = 0; }