Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-10 15:10:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Staging: rtl8712: fix math errors in snprintf()

Browse Source 
The original code had calls to snprintf(p, 7, "wpa_ie=") but that string
is 8 characters (because snprintf() puts a NUL terminator on the end).
So instead of an '=' the what gets written to buf is a NUL terminator
followed by the rest of the string.

And actually the %02x formats are three chars as well when you include
the terminator.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dan Carpenter 2011-02-09 01:45:13 +03:00 committed by Greg Kroah-Hartman
parent ec42dc2c7f
commit d936435f20
1 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/staging/rtl8712/rtl871x_ioctl_linux.c
View File

@ -281,18 +281,20 @@ static inline char *translate_scan(struct _adapter *padapter,
/* parsing WPA/WPA2 IE */
{
u16 wpa_len = 0, rsn_len = 0;
u8 *p;
int n;
sint out_len = 0;
out_len = r8712_get_sec_ie(pnetwork->network.IEs,
pnetwork->network.
IELength, rsn_ie, &rsn_len,
wpa_ie, &wpa_len);
if (wpa_len > 0) {
p = buf;
memset(buf, 0, MAX_WPA_IE_LEN);
p += snprintf(p, 7, "wpa_ie=");
for (i = 0; i < wpa_len; i++)
p += snprintf(p, 2, "%02x", wpa_ie[i]);
n = sprintf(buf, "wpa_ie=");
for (i = 0; i < wpa_len; i++) {
n += snprintf(buf + n, MAX_WPA_IE_LEN - n, "%02x", wpa_ie[i]);
if (n >= MAX_WPA_IE_LEN)
break;
}
memset(&iwe, 0, sizeof(iwe));
iwe.cmd = IWEVCUSTOM;
iwe.u.data.length = (u16)strlen(buf);
@ -305,11 +307,13 @@ static inline char *translate_scan(struct _adapter *padapter,
&iwe, wpa_ie);
}
if (rsn_len > 0) {
p = buf;
memset(buf, 0, MAX_WPA_IE_LEN);
p += snprintf(p, 7, "rsn_ie=");
for (i = 0; i < rsn_len; i++)
p += snprintf(p, 2, "%02x", rsn_ie[i]);
n = sprintf(buf, "rsn_ie=");
for (i = 0; i < rsn_len; i++) {
n += snprintf(buf + n, MAX_WPA_IE_LEN - n, "%02x", rsn_ie[i]);
if (n >= MAX_WPA_IE_LEN)
break;
}
memset(&iwe, 0, sizeof(iwe));
iwe.cmd = IWEVCUSTOM;
iwe.u.data.length = strlen(buf);