if (copy_from_user (&cp, data,
sizeof (struct sbecom_chan_param)))
return -EFAULT;
- sprintf (buf, CHANNAME "%d", cp.channum);
+ if (cp.channum > 999)
+ return -EINVAL;
+ snprintf (buf, sizeof(buf), CHANNAME "%d", cp.channum);
if (!(dev = dev_get_by_name (&init_net, buf)))
return -ENOENT;
dev_put (dev);