lkml.org 
[lkml]   [2019]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.4 64/77] wireless: airo: potential buffer overflow in sprintf()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac ]

    It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
    of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
    (precision) so if the ssid doesn't have a NUL terminator this could lead
    to an overflow.

    Static analysis. Not tested.

    Fixes: e174961ca1a0 ("net: convert print_mac to %pM")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/airo.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
    index 17c40f06f13e5..82d24f2b9c190 100644
    --- a/drivers/net/wireless/airo.c
    +++ b/drivers/net/wireless/airo.c
    @@ -5484,7 +5484,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
    we have to add a spin lock... */
    rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);
    while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {
    - ptr += sprintf(ptr, "%pM %*s rssi = %d",
    + ptr += sprintf(ptr, "%pM %.*s rssi = %d",
    BSSList_rid.bssid,
    (int)BSSList_rid.ssidLen,
    BSSList_rid.ssid,
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-11-16 16:57    [W:2.511 / U:1.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site