diff options
author | Takashi Iwai <tiwai@suse.de> | 2020-03-11 10:24:51 +0100 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-03-12 09:23:59 +0100 |
commit | 038341dc5f7be6793d582d4731cb313cc90439c3 (patch) | |
tree | da814504a2931ccea15b5ab002097ad6b7dbf84b | |
parent | 39ddadf14da77c5c7176e0395db5f832b7da06c0 (diff) |
staging: rtl8723bs: Use scnprintf() for avoiding potential buffer overflow
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit. Fix it by replacing with scnprintf().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311092451.23933-4-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r-- | drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 14 | ||||
-rw-r--r-- | drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 4 |
2 files changed, 9 insertions, 9 deletions
diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c index 9590e6f351c1..49807d865e32 100644 --- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c +++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c @@ -326,20 +326,20 @@ inline void rtw_set_oper_ch(struct adapter *adapter, u8 ch) dvobj->on_oper_ch_time = jiffies; #ifdef DBG_CH_SWITCH - cnt += snprintf(msg+cnt, len-cnt, "switch to ch %3u", ch); + cnt += scnprintf(msg+cnt, len-cnt, "switch to ch %3u", ch); for (i = 0; i < dvobj->iface_nums; i++) { struct adapter *iface = dvobj->padapters[i]; - cnt += snprintf(msg+cnt, len-cnt, " ["ADPT_FMT":", ADPT_ARG(iface)); + cnt += scnprintf(msg+cnt, len-cnt, " ["ADPT_FMT":", ADPT_ARG(iface)); if (iface->mlmeextpriv.cur_channel == ch) - cnt += snprintf(msg+cnt, len-cnt, "C"); + cnt += scnprintf(msg+cnt, len-cnt, "C"); else - cnt += snprintf(msg+cnt, len-cnt, "_"); + cnt += scnprintf(msg+cnt, len-cnt, "_"); if (iface->wdinfo.listen_channel == ch && !rtw_p2p_chk_state(&iface->wdinfo, P2P_STATE_NONE)) - cnt += snprintf(msg+cnt, len-cnt, "L"); + cnt += scnprintf(msg+cnt, len-cnt, "L"); else - cnt += snprintf(msg+cnt, len-cnt, "_"); - cnt += snprintf(msg+cnt, len-cnt, "]"); + cnt += scnprintf(msg+cnt, len-cnt, "_"); + cnt += scnprintf(msg+cnt, len-cnt, "]"); } DBG_871X(FUNC_ADPT_FMT" %s\n", FUNC_ADPT_ARG(adapter), msg); diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c index c145f629488a..29f36cca3972 100644 --- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c @@ -197,12 +197,12 @@ static char *translate_scan(struct adapter *padapter, if (!custom) return start; p = custom; - p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): "); + p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): "); while (pnetwork->network.SupportedRates[i] != 0) { rate = pnetwork->network.SupportedRates[i]&0x7F; if (rate > max_rate) max_rate = rate; - p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), + p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom), "%d%s ", rate >> 1, (rate & 1) ? ".5" : ""); i++; } |