Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3d39e1bb authored by Dan Carpenter's avatar Dan Carpenter Committed by Kalle Valo
Browse files

wireless: airo: potential buffer overflow in sprintf() 



It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
(precision) so if the ssid doesn't have a NUL terminator this could lead
to an overflow.

Static analysis.  Not tested.

Fixes: e174961c ("net: convert print_mac to %pM")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 963b3073

drivers/net/wireless/cisco/airo.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -5462,7 +5462,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) { 
           we have to add a spin lock... */

           we have to add a spin lock... */

	rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);

	rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);

	while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {

	while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {

		ptr += sprintf(ptr, "%pM %*s rssi = %d",

		ptr += sprintf(ptr, "%pM %.*s rssi = %d",

			       BSSList_rid.bssid,

			       BSSList_rid.bssid,

				(int)BSSList_rid.ssidLen,

				(int)BSSList_rid.ssidLen,

				BSSList_rid.ssid,

				BSSList_rid.ssid,