vgaarb: Check snprintf return valueHEADmaster

snprintf() might return a negative value if an error occurs.
Check its return value before using it in vgaarb_write().

Signed-off-by: José Expósito <jexposit@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libpciaccess/-/merge_requests/35>

1 files changed, 11 insertions, 0 deletions

diff --git a/src/common_vgaarb.c b/src/common_vgaarb.c
index 515275f..a1edfab 100644
--- a/src/common_vgaarb.c
+++ b/src/common_vgaarb.c
@@ -238,6 +238,8 @@ pci_device_vgaarb_set_target(struct pci_device *dev)
 
     len = snprintf(buf, BUFSIZE, "target PCI:%04x:%02x:%02x.%x",
                    dev->domain, dev->bus, dev->dev, dev->func);
+    if (len < 0 || len >= BUFSIZE)
+        return -1;
 
     ret = vgaarb_write(pci_sys->vgaarb_fd, buf, len);
     if (ret)
@@ -268,6 +270,9 @@ pci_device_vgaarb_decodes(int new_vgaarb_rsrc)
         return 0;
 
     len = snprintf(buf, BUFSIZE, "decodes %s", rsrc_to_str(new_vgaarb_rsrc));
+    if (len < 0 || len >= BUFSIZE)
+        return -1;
+
     ret = vgaarb_write(pci_sys->vgaarb_fd, buf, len);
     if (ret == 0)
         dev->vgaarb_rsrc = new_vgaarb_rsrc;
@@ -297,6 +302,8 @@ pci_device_vgaarb_lock(void)
         return 0;
 
     len = snprintf(buf, BUFSIZE, "lock %s", rsrc_to_str(dev->vgaarb_rsrc));
+    if (len < 0 || len >= BUFSIZE)
+        return -1;
 
     return vgaarb_write(pci_sys->vgaarb_fd, buf, len);
 }
@@ -315,6 +322,8 @@ pci_device_vgaarb_trylock(void)
         return 0;
 
     len = snprintf(buf, BUFSIZE, "trylock %s", rsrc_to_str(dev->vgaarb_rsrc));
+    if (len < 0 || len >= BUFSIZE)
+        return -1;
 
     return vgaarb_write(pci_sys->vgaarb_fd, buf, len);
 }
@@ -333,6 +342,8 @@ pci_device_vgaarb_unlock(void)
         return 0;
 
     len = snprintf(buf, BUFSIZE, "unlock %s", rsrc_to_str(dev->vgaarb_rsrc));
+    if (len < 0 || len >= BUFSIZE)
+        return -1;
 
     return vgaarb_write(pci_sys->vgaarb_fd, buf, len);
 }