OSDN Git Service

wireless: airo: potential buffer overflow in sprintf()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 24 Oct 2018 08:33:34 +0000 (11:33 +0300)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 6 Nov 2018 17:02:43 +0000 (19:02 +0200)
commit3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac
tree9789c8b7de1adb4a0184490abae8fd865951dff3
parent963b307361bd415b6979910b1ef0c39bfee7f70c
wireless: airo: potential buffer overflow in sprintf()

It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
(precision) so if the ssid doesn't have a NUL terminator this could lead
to an overflow.

Static analysis.  Not tested.

Fixes: e174961ca1a0 ("net: convert print_mac to %pM")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/cisco/airo.c