staging: rtl8192e: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20200311092451.23933-3-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
72e7375caf
commit
39ddadf14d
|
@ -2092,7 +2092,7 @@ int rtllib_parse_info_param(struct rtllib_device *ieee,
|
|||
MAX_RATES_LENGTH);
|
||||
for (i = 0; i < network->rates_len; i++) {
|
||||
network->rates[i] = info_element->data[i];
|
||||
p += snprintf(p, sizeof(rates_str) -
|
||||
p += scnprintf(p, sizeof(rates_str) -
|
||||
(p - rates_str), "%02X ",
|
||||
network->rates[i]);
|
||||
if (rtllib_is_ofdm_rate
|
||||
|
@ -2120,7 +2120,7 @@ int rtllib_parse_info_param(struct rtllib_device *ieee,
|
|||
MAX_RATES_EX_LENGTH);
|
||||
for (i = 0; i < network->rates_ex_len; i++) {
|
||||
network->rates_ex[i] = info_element->data[i];
|
||||
p += snprintf(p, sizeof(rates_str) -
|
||||
p += scnprintf(p, sizeof(rates_str) -
|
||||
(p - rates_str), "%02X ",
|
||||
network->rates_ex[i]);
|
||||
if (rtllib_is_ofdm_rate
|
||||
|
|
|
@ -114,7 +114,7 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee,
|
|||
/* Add basic and extended rates */
|
||||
max_rate = 0;
|
||||
p = custom;
|
||||
p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
|
||||
p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
|
||||
for (i = 0, j = 0; i < network->rates_len;) {
|
||||
if (j < network->rates_ex_len &&
|
||||
((network->rates_ex[j] & 0x7F) <
|
||||
|
@ -124,12 +124,12 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee,
|
|||
rate = network->rates[i++] & 0x7F;
|
||||
if (rate > max_rate)
|
||||
max_rate = rate;
|
||||
p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
|
||||
p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),
|
||||
"%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
|
||||
}
|
||||
for (; j < network->rates_ex_len; j++) {
|
||||
rate = network->rates_ex[j] & 0x7F;
|
||||
p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
|
||||
p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),
|
||||
"%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
|
||||
if (rate > max_rate)
|
||||
max_rate = rate;
|
||||
|
@ -226,7 +226,7 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee,
|
|||
*/
|
||||
iwe.cmd = IWEVCUSTOM;
|
||||
p = custom;
|
||||
p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
|
||||
p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),
|
||||
" Last beacon: %lums ago",
|
||||
(jiffies - network->last_scanned) / (HZ / 100));
|
||||
iwe.u.data.length = p - custom;
|
||||
|
|
Loading…
Reference in a new issue