lkml.org 
[lkml]   [2019]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 093/151] wireless: airo: potential buffer overflow in sprintf()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac ]

    It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
    of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
    (precision) so if the ssid doesn't have a NUL terminator this could lead
    to an overflow.

    Static analysis. Not tested.

    Fixes: e174961ca1a0 ("net: convert print_mac to %pM")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/cisco/airo.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
    index 69b826d229c5b..04939e576ee02 100644
    --- a/drivers/net/wireless/cisco/airo.c
    +++ b/drivers/net/wireless/cisco/airo.c
    @@ -5472,7 +5472,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
    we have to add a spin lock... */
    rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);
    while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {
    - ptr += sprintf(ptr, "%pM %*s rssi = %d",
    + ptr += sprintf(ptr, "%pM %.*s rssi = %d",
    BSSList_rid.bssid,
    (int)BSSList_rid.ssidLen,
    BSSList_rid.ssid,
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-11-27 21:44    [W:4.106 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site