diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-10-24 11:33:34 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2018-11-06 20:02:43 +0300 |
| commit | 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac (patch) | |
| tree | 9789c8b7de1adb4a0184490abae8fd865951dff3 /drivers/net/wireless/cisco | |
| parent | 963b307361bd415b6979910b1ef0c39bfee7f70c (diff) | |
| download | linux-3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac.tar.xz | |
wireless: airo: potential buffer overflow in sprintf()
It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
(precision) so if the ssid doesn't have a NUL terminator this could lead
to an overflow.
Static analysis. Not tested.
Fixes: e174961ca1a0 ("net: convert print_mac to %pM")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/cisco')
| -rw-r--r-- | drivers/net/wireless/cisco/airo.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c index 04dd7a936593..5512c7f73fce 100644 --- a/drivers/net/wireless/cisco/airo.c +++ b/drivers/net/wireless/cisco/airo.c @@ -5462,7 +5462,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) { we have to add a spin lock... */ rc = readBSSListRid(ai, doLoseSync, &BSSList_rid); while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) { - ptr += sprintf(ptr, "%pM %*s rssi = %d", + ptr += sprintf(ptr, "%pM %.*s rssi = %d", BSSList_rid.bssid, (int)BSSList_rid.ssidLen, BSSList_rid.ssid, |