diff options
| author | Eliad Peller <eliad@wizery.com> | 2013-08-27 12:40:15 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2013-10-01 12:16:51 +0200 |
| commit | f364ef99a8e82ee27933d6a0cf5cc1f27e9f0df9 (patch) | |
| tree | 1efd470df60143de6acd2beb73314f7f173711ad /net/wireless | |
| parent | ee4bc9e75811d2c0cb5f2a2fc5b51ff037a01f47 (diff) | |
| download | linux-f364ef99a8e82ee27933d6a0cf5cc1f27e9f0df9.tar.bz2 | |
mac80211: fix some snprintf misuses
In some debugfs related functions snprintf was used
while scnprintf should have been used instead.
(blindly adding the return value of snprintf and supplying
it to the next snprintf might result in buffer overflow when
the input is too big)
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/debugfs.c | 24 |
1 files changed, 13 insertions, 11 deletions
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c index 90d050036624..454157717efa 100644 --- a/net/wireless/debugfs.c +++ b/net/wireless/debugfs.c @@ -47,17 +47,19 @@ static int ht_print_chan(struct ieee80211_channel *chan, return 0; if (chan->flags & IEEE80211_CHAN_DISABLED) - return snprintf(buf + offset, - buf_size - offset, - "%d Disabled\n", - chan->center_freq); - - return snprintf(buf + offset, - buf_size - offset, - "%d HT40 %c%c\n", - chan->center_freq, - (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ? ' ' : '-', - (chan->flags & IEEE80211_CHAN_NO_HT40PLUS) ? ' ' : '+'); + return scnprintf(buf + offset, + buf_size - offset, + "%d Disabled\n", + chan->center_freq); + + return scnprintf(buf + offset, + buf_size - offset, + "%d HT40 %c%c\n", + chan->center_freq, + (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ? + ' ' : '-', + (chan->flags & IEEE80211_CHAN_NO_HT40PLUS) ? + ' ' : '+'); } static ssize_t ht40allow_map_read(struct file *file, |