summaryrefslogtreecommitdiffstats
path: root/net/wireless
diff options
context:
space:
mode:
authorEliad Peller <eliad@wizery.com>2013-08-27 12:40:15 +0300
committerJohannes Berg <johannes.berg@intel.com>2013-10-01 12:16:51 +0200
commitf364ef99a8e82ee27933d6a0cf5cc1f27e9f0df9 (patch)
tree1efd470df60143de6acd2beb73314f7f173711ad /net/wireless
parentee4bc9e75811d2c0cb5f2a2fc5b51ff037a01f47 (diff)
downloadop-kernel-dev-f364ef99a8e82ee27933d6a0cf5cc1f27e9f0df9.zip
op-kernel-dev-f364ef99a8e82ee27933d6a0cf5cc1f27e9f0df9.tar.gz
mac80211: fix some snprintf misuses
In some debugfs related functions snprintf was used while scnprintf should have been used instead. (blindly adding the return value of snprintf and supplying it to the next snprintf might result in buffer overflow when the input is too big) Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
-rw-r--r--net/wireless/debugfs.c24
1 files changed, 13 insertions, 11 deletions
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 90d0500..4541577 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -47,17 +47,19 @@ static int ht_print_chan(struct ieee80211_channel *chan,
return 0;
if (chan->flags & IEEE80211_CHAN_DISABLED)
- return snprintf(buf + offset,
- buf_size - offset,
- "%d Disabled\n",
- chan->center_freq);
-
- return snprintf(buf + offset,
- buf_size - offset,
- "%d HT40 %c%c\n",
- chan->center_freq,
- (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ? ' ' : '-',
- (chan->flags & IEEE80211_CHAN_NO_HT40PLUS) ? ' ' : '+');
+ return scnprintf(buf + offset,
+ buf_size - offset,
+ "%d Disabled\n",
+ chan->center_freq);
+
+ return scnprintf(buf + offset,
+ buf_size - offset,
+ "%d HT40 %c%c\n",
+ chan->center_freq,
+ (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ?
+ ' ' : '-',
+ (chan->flags & IEEE80211_CHAN_NO_HT40PLUS) ?
+ ' ' : '+');
}
static ssize_t ht40allow_map_read(struct file *file,
OpenPOWER on IntegriCloud