Commit 39ddadf1 authored by Takashi Iwai's avatar Takashi Iwai Committed by Greg Kroah-Hartman
Browse files

staging: rtl8192e: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311092451.23933-3-tiwai@suse.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 72e7375c

drivers/staging/rtl8192e/rtllib_rx.c

+2 −2
Original line number Diff line number Diff line
@@ -2092,7 +2092,7 @@ int rtllib_parse_info_param(struct rtllib_device *ieee, 
						 MAX_RATES_LENGTH);

			for (i = 0; i < network->rates_len; i++) {

				network->rates[i] = info_element->data[i];

				p += snprintf(p, sizeof(rates_str) -

				p += scnprintf(p, sizeof(rates_str) -

					      (p - rates_str), "%02X ",

					      network->rates[i]);

				if (rtllib_is_ofdm_rate
@@ -2120,7 +2120,7 @@ int rtllib_parse_info_param(struct rtllib_device *ieee, 
						    MAX_RATES_EX_LENGTH);

			for (i = 0; i < network->rates_ex_len; i++) {

				network->rates_ex[i] = info_element->data[i];

				p += snprintf(p, sizeof(rates_str) -

				p += scnprintf(p, sizeof(rates_str) -

					      (p - rates_str), "%02X ",

					      network->rates_ex[i]);

				if (rtllib_is_ofdm_rate

drivers/staging/rtl8192e/rtllib_wx.c

+4 −4
Original line number Diff line number Diff line
@@ -114,7 +114,7 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee, 
	/* Add basic and extended rates */

	max_rate = 0;

	p = custom;

	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");

	p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");

	for (i = 0, j = 0; i < network->rates_len;) {

		if (j < network->rates_ex_len &&

		    ((network->rates_ex[j] & 0x7F) <
@@ -124,12 +124,12 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee, 
			rate = network->rates[i++] & 0x7F;

		if (rate > max_rate)

			max_rate = rate;

		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),

		p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),

			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");

	}

	for (; j < network->rates_ex_len; j++) {

		rate = network->rates_ex[j] & 0x7F;

		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),

		p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),

			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");

		if (rate > max_rate)

			max_rate = rate;
@@ -226,7 +226,7 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee, 
	 */

	iwe.cmd = IWEVCUSTOM;

	p = custom;

	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),

	p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),

		      " Last beacon: %lums ago",

		      (jiffies - network->last_scanned) / (HZ / 100));

	iwe.u.data.length = p - custom;