wireless: airo: potential buffer overflow in sprintf()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 24 Oct 2018 08:33:34 +0000 (11:33 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 1 Dec 2019 08:17:23 +0000 (09:17 +0100)
commit13d434fed1a2ce7c11b1c3a95a1c20c86b2bf8a7
tree4eacb45d254228d9434b8b2f81514f153fc7760f
parentfad934bb2e476d90957af95c8d51ede3bbfca4c9
wireless: airo: potential buffer overflow in sprintf()

[ Upstream commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac ]

It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
(precision) so if the ssid doesn't have a NUL terminator this could lead
to an overflow.

Static analysis.  Not tested.

Fixes: e174961ca1a0 ("net: convert print_mac to %pM")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/cisco/airo.c