]> git.baikalelectronics.ru Git - kernel.git/commit
wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
authorColin Ian King <colin.king@canonical.com>
Mon, 19 Apr 2021 14:14:05 +0000 (15:14 +0100)
committerKalle Valo <kvalo@codeaurora.org>
Thu, 22 Apr 2021 14:39:29 +0000 (17:39 +0300)
commitb7c5aa791a9c28ab62d48cc1a7c00448c1c280e1
tree34bc691b48d164ebb4d929514325800af284bc2f
parenta6315f58a737ba56278d31e424285bd7ea44b4dc
wlcore: Fix buffer overrun by snprintf due to incorrect buffer size

The size of the buffer than can be written to is currently incorrect, it is
always the size of the entire buffer even though the snprintf is writing
as position pos into the buffer. Fix this by setting the buffer size to be
the number of bytes left in the buffer, namely sizeof(buf) - pos.

Addresses-Coverity: ("Out-of-bounds access")
Fixes: d4fb55acf1b4 ("wlcore: fix overlapping snprintf arguments in debugfs")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210419141405.180582-1-colin.king@canonical.com
drivers/net/wireless/ti/wlcore/debugfs.h