mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-29 23:53:32 +00:00
Code Issues Releases Wiki Activity

staging: rtl8188eu: Use scnprintf() for avoiding potential buffer overflow

Browse source 
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311092451.23933-2-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Takashi Iwai 2020-03-11 10:24:49 +01:00 committed by Greg Kroah-Hartman
parent 234ff54287
commit 72e7375caf
2 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/staging/rtl8188eu/core/rtw_debug.c
View file

@ -15,7 +15,7 @@ int proc_get_drv_version(char *page, char **start,
{
int len = 0;
len += snprintf(page + len, count - len, "%s\n", DRIVERVERSION);
len += scnprintf(page + len, count - len, "%s\n", DRIVERVERSION);
*eof = 1;
return len;
@ -86,16 +86,16 @@ int proc_get_read_reg(char *page, char **start,
switch (proc_get_read_len) {
case 1:
len += snprintf(page + len, count - len, "usb_read8(0x%x)=0x%x\n", proc_get_read_addr, usb_read8(padapter, proc_get_read_addr));
len += scnprintf(page + len, count - len, "usb_read8(0x%x)=0x%x\n", proc_get_read_addr, usb_read8(padapter, proc_get_read_addr));
break;
case 2:
len += snprintf(page + len, count - len, "usb_read16(0x%x)=0x%x\n", proc_get_read_addr, usb_read16(padapter, proc_get_read_addr));
len += scnprintf(page + len, count - len, "usb_read16(0x%x)=0x%x\n", proc_get_read_addr, usb_read16(padapter, proc_get_read_addr));
break;
case 4:
len += snprintf(page + len, count - len, "usb_read32(0x%x)=0x%x\n", proc_get_read_addr, usb_read32(padapter, proc_get_read_addr));
len += scnprintf(page + len, count - len, "usb_read32(0x%x)=0x%x\n", proc_get_read_addr, usb_read32(padapter, proc_get_read_addr));
break;
default:
len += snprintf(page + len, count - len, "error read length=%d\n", proc_get_read_len);
len += scnprintf(page + len, count - len, "error read length=%d\n", proc_get_read_len);
break;
}
@ -138,7 +138,7 @@ int proc_get_adapter_state(char *page, char **start,
struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
int len = 0;
len += snprintf(page + len, count - len, "bSurpriseRemoved=%d, bDriverStopped=%d\n",
len += scnprintf(page + len, count - len, "bSurpriseRemoved=%d, bDriverStopped=%d\n",
padapter->bSurpriseRemoved, padapter->bDriverStopped);
*eof = 1;
@ -170,11 +170,11 @@ int proc_get_best_channel(char *page, char **start,
}
/* debug */
len += snprintf(page + len, count - len, "The rx cnt of channel %3d = %d\n",
len += scnprintf(page + len, count - len, "The rx cnt of channel %3d = %d\n",
pmlmeext->channel_set[i].ChannelNum, pmlmeext->channel_set[i].rx_count);
}
len += snprintf(page + len, count - len, "best_channel_24G = %d\n", best_channel_24G);
len += scnprintf(page + len, count - len, "best_channel_24G = %d\n", best_channel_24G);
*eof = 1;
return len;

4
drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
View file

@ -193,12 +193,12 @@ static char *translate_scan(struct adapter *padapter,
/*Add basic and extended rates */
max_rate = 0;
p = custom;
p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
while (pnetwork->network.SupportedRates[i] != 0) {
rate = pnetwork->network.SupportedRates[i]&0x7F;
if (rate > max_rate)
max_rate = rate;
p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),
"%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
i++;
}