Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 13d434fe authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

wireless: airo: potential buffer overflow in sprintf() 



[ Upstream commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac ]

It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
(precision) so if the ssid doesn't have a NUL terminator this could lead
to an overflow.

Static analysis.  Not tested.

Fixes: e174961c ("net: convert print_mac to %pM")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent fad934bb

drivers/net/wireless/cisco/airo.c

+1 −1
Original line number Diff line number Diff line
@@ -5462,7 +5462,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) { 
           we have to add a spin lock... */

	rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);

	while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {

		ptr += sprintf(ptr, "%pM %*s rssi = %d",

		ptr += sprintf(ptr, "%pM %.*s rssi = %d",

			       BSSList_rid.bssid,

				(int)BSSList_rid.ssidLen,

				BSSList_rid.ssid,