Staging: rtl8712: fix math errors in snprintf()
Subsystems (2)
PATCH 1/1 Staging: rtl8712: fix math errors in snprintf()
The original code had calls to snprintf(p, 7, "wpa_ie=") but that string is 8 characters (because snprintf() puts a NUL terminator on the end). So instead of an '=' the what gets written to buf is a NUL terminator followed by the rest of the string.
And actually the %02x formats are three chars as well when you include the terminator.
Signed-off-by Dan Carpenter <[email protected]>
---
Compile tested only.
drivers/staging/rtl8712/rtl871x_ioctl_linux.c +13 -9
@@ -280,18 +280,20 @@ static inline char *translate_scan(struct _adapter *padapter,/* parsing WPA/WPA2 IE */ {u16 wpa_len =0 , rsn_len =0 ; -u8 *p; +int n;sint out_len =0 ; out_len =r8712_get_sec_ie (pnetwork->network.IEs, pnetwork->network. IELength, rsn_ie, &rsn_len, wpa_ie, &wpa_len);if (wpa_len >0 ) { - p = buf;memset (buf,0 ,MAX_WPA_IE_LEN ); - p +=snprintf (p,7 ,"wpa_ie=" ); -for (i =0 ; i < wpa_len; i++) - p +=snprintf (p,2 ,"%02x" , wpa_ie[i]); + n =sprintf (buf,"wpa_ie=" ); +for (i =0 ; i < wpa_len; i++) { + n +=snprintf (buf + n,MAX_WPA_IE_LEN - n,"%02x" , wpa_ie[i]); +if (n >=MAX_WPA_IE_LEN ) +break ; + }memset (&iwe,0 ,sizeof (iwe)); iwe.cmd =IWEVCUSTOM ; iwe.u.data.length = (u16 )strlen (buf);
@@ -304,11 +306,13 @@ static inline char *translate_scan(struct _adapter *padapter, &iwe, wpa_ie); }if (rsn_len >0 ) { - p = buf;memset (buf,0 ,MAX_WPA_IE_LEN ); - p +=snprintf (p,7 ,"rsn_ie=" ); -for (i =0 ; i < rsn_len; i++) - p +=snprintf (p,2 ,"%02x" , rsn_ie[i]); + n =sprintf (buf,"rsn_ie=" ); +for (i =0 ; i < rsn_len; i++) { + n +=snprintf (buf + n,MAX_WPA_IE_LEN - n,"%02x" , rsn_ie[i]); +if (n >=MAX_WPA_IE_LEN ) +break ; + }memset (&iwe,0 ,sizeof (iwe)); iwe.cmd =IWEVCUSTOM ; iwe.u.data.length =strlen (buf);