| From 3989c2ca3cde389f105a81a334f68f23c919d5d6 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 24 Oct 2018 11:33:34 +0300 |
| Subject: wireless: airo: potential buffer overflow in sprintf() |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| [ Upstream commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac ] |
| |
| It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes |
| of the ssid, but we accidentally use "%*s" (width) instead of "%.*s" |
| (precision) so if the ssid doesn't have a NUL terminator this could lead |
| to an overflow. |
| |
| Static analysis. Not tested. |
| |
| Fixes: e174961ca1a0 ("net: convert print_mac to %pM") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/cisco/airo.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c |
| index 04dd7a9365938..5512c7f73fce8 100644 |
| --- a/drivers/net/wireless/cisco/airo.c |
| +++ b/drivers/net/wireless/cisco/airo.c |
| @@ -5462,7 +5462,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) { |
| we have to add a spin lock... */ |
| rc = readBSSListRid(ai, doLoseSync, &BSSList_rid); |
| while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) { |
| - ptr += sprintf(ptr, "%pM %*s rssi = %d", |
| + ptr += sprintf(ptr, "%pM %.*s rssi = %d", |
| BSSList_rid.bssid, |
| (int)BSSList_rid.ssidLen, |
| BSSList_rid.ssid, |
| -- |
| 2.20.1 |
| |
