|
@@ -1712,18 +1712,16 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
|
|
|
break;
|
|
|
|
|
|
case FORMAT_TYPE_NRCHARS: {
|
|
|
- u8 qualifier = spec.qualifier;
|
|
|
+ /*
|
|
|
+ * Since %n poses a greater security risk than
|
|
|
+ * utility, ignore %n and skip its argument.
|
|
|
+ */
|
|
|
+ void *skip_arg;
|
|
|
|
|
|
- if (qualifier == 'l') {
|
|
|
- long *ip = va_arg(args, long *);
|
|
|
- *ip = (str - buf);
|
|
|
- } else if (_tolower(qualifier) == 'z') {
|
|
|
- size_t *ip = va_arg(args, size_t *);
|
|
|
- *ip = (str - buf);
|
|
|
- } else {
|
|
|
- int *ip = va_arg(args, int *);
|
|
|
- *ip = (str - buf);
|
|
|
- }
|
|
|
+ WARN_ONCE(1, "Please remove ignored %%n in '%s'\n",
|
|
|
+ old_fmt);
|
|
|
+
|
|
|
+ skip_arg = va_arg(args, void *);
|
|
|
break;
|
|
|
}
|
|
|
|