提交 d936435f 编写于 作者: D Dan Carpenter 提交者: Greg Kroah-Hartman

Staging: rtl8712: fix math errors in snprintf()

The original code had calls to snprintf(p, 7, "wpa_ie=") but that string
is 8 characters (because snprintf() puts a NUL terminator on the end).
So instead of an '=' the what gets written to buf is a NUL terminator
followed by the rest of the string.

And actually the %02x formats are three chars as well when you include
the terminator.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
上级 ec42dc2c
...@@ -281,18 +281,20 @@ static inline char *translate_scan(struct _adapter *padapter, ...@@ -281,18 +281,20 @@ static inline char *translate_scan(struct _adapter *padapter,
/* parsing WPA/WPA2 IE */ /* parsing WPA/WPA2 IE */
{ {
u16 wpa_len = 0, rsn_len = 0; u16 wpa_len = 0, rsn_len = 0;
u8 *p; int n;
sint out_len = 0; sint out_len = 0;
out_len = r8712_get_sec_ie(pnetwork->network.IEs, out_len = r8712_get_sec_ie(pnetwork->network.IEs,
pnetwork->network. pnetwork->network.
IELength, rsn_ie, &rsn_len, IELength, rsn_ie, &rsn_len,
wpa_ie, &wpa_len); wpa_ie, &wpa_len);
if (wpa_len > 0) { if (wpa_len > 0) {
p = buf;
memset(buf, 0, MAX_WPA_IE_LEN); memset(buf, 0, MAX_WPA_IE_LEN);
p += snprintf(p, 7, "wpa_ie="); n = sprintf(buf, "wpa_ie=");
for (i = 0; i < wpa_len; i++) for (i = 0; i < wpa_len; i++) {
p += snprintf(p, 2, "%02x", wpa_ie[i]); n += snprintf(buf + n, MAX_WPA_IE_LEN - n, "%02x", wpa_ie[i]);
if (n >= MAX_WPA_IE_LEN)
break;
}
memset(&iwe, 0, sizeof(iwe)); memset(&iwe, 0, sizeof(iwe));
iwe.cmd = IWEVCUSTOM; iwe.cmd = IWEVCUSTOM;
iwe.u.data.length = (u16)strlen(buf); iwe.u.data.length = (u16)strlen(buf);
...@@ -305,11 +307,13 @@ static inline char *translate_scan(struct _adapter *padapter, ...@@ -305,11 +307,13 @@ static inline char *translate_scan(struct _adapter *padapter,
&iwe, wpa_ie); &iwe, wpa_ie);
} }
if (rsn_len > 0) { if (rsn_len > 0) {
p = buf;
memset(buf, 0, MAX_WPA_IE_LEN); memset(buf, 0, MAX_WPA_IE_LEN);
p += snprintf(p, 7, "rsn_ie="); n = sprintf(buf, "rsn_ie=");
for (i = 0; i < rsn_len; i++) for (i = 0; i < rsn_len; i++) {
p += snprintf(p, 2, "%02x", rsn_ie[i]); n += snprintf(buf + n, MAX_WPA_IE_LEN - n, "%02x", rsn_ie[i]);
if (n >= MAX_WPA_IE_LEN)
break;
}
memset(&iwe, 0, sizeof(iwe)); memset(&iwe, 0, sizeof(iwe));
iwe.cmd = IWEVCUSTOM; iwe.cmd = IWEVCUSTOM;
iwe.u.data.length = strlen(buf); iwe.u.data.length = strlen(buf);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册