Messages in this thread | | | From | Colin Ian King <> | Subject | static analysis bug report: staging: rtl8192u: use of uninitialized array | Date | Mon, 18 Mar 2019 11:44:35 +0000 |
| |
Hi,
static analysis with cppcheck has detected use of an uninitialized array tmp_ssid in drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c in function ieee80211_softmac_new_net()
Array tmp_ssid is only initialized when ssidbroad is non-null, however it is being copied and the copy of this is being printk'd later on:
if (!ssidbroad) { strncpy(tmp_ssid, ieee->current_network.ssid, IW_ESSID_MAX_SIZE);
tmp_ssid is initialized only here ^^
tmp_ssid_len = ieee->current_network.ssid_len; } memcpy(&ieee->current_network, net, sizeof(struct ieee80211_network));
strncpy(ieee->current_network.ssid, tmp_ssid, IW_ESSID_MAX_SIZE);
tmp_ssid is being copied from here ^^
ieee->current_network.ssid_len = tmp_ssid_len; printk(KERN_INFO"Linking with %s,channel:%d, qos:%d, myHT:%d, networkHT:%d\n", ieee->current_network.ssid, ieee->current_network.channel, ieee->current_network.qos_data.supported, ieee->pHTInfo->bEnableHT, ieee->current_network.bssht.bdSupportHT);
copy of tmp_ssid is being printk'd here ^^
So potentially a garbage non-null terminated string is being printk'd. Not sure what the fix is for the case where ssidbroad is non-null, what should tmp_ssid be in that situation?
Colin
| |