net: rtl88xx: Fix stringop-overread warnings

Reading variable lenght from length 40 char array causes stringop-
overread build warnings. Fix the warnings by adjusting size with
min value.

Change-Id: I0661bd7f62cba127c965c429a5eccfce6b74fa82
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

diff --git a/drivers/net/wireless/rtl8188eu/core/rtw_br_ext.c b/drivers/net/wireless/rtl8188eu/core/rtw_br_ext.c
index 1236f50..ce7cc74 100644 (file)
--- a/drivers/net/wireless/rtl8188eu/core/rtw_br_ext.c
+++ b/drivers/net/wireless/rtl8188eu/core/rtw_br_ext.c
@@ -93,6 +93,9 @@ static inline int __nat25_add_pppoe_tag(struct sk_buff *skb, struct pppoe_tag *t
                return -1;
        }
 
+       if (data_len > 40)
+               data_len = 40;
+
        skb_put(skb, data_len);
        /*  have a room for new tag */
        memmove(((unsigned char *)ph->tag + data_len), (unsigned char *)ph->tag, ntohs(ph->length));

diff --git a/drivers/net/wireless/rtl8192cu/core/rtw_br_ext.c b/drivers/net/wireless/rtl8192cu/core/rtw_br_ext.c
index 2f84a38..96def9d 100644 (file)
--- a/drivers/net/wireless/rtl8192cu/core/rtw_br_ext.c
+++ b/drivers/net/wireless/rtl8192cu/core/rtw_br_ext.c
@@ -114,6 +114,9 @@ static __inline__ int __nat25_add_pppoe_tag(struct sk_buff *skb, struct pppoe_ta
                return -1;
        }
 
+       if (data_len > 40)
+               data_len = 40;
+
        skb_put(skb, data_len);
        // have a room for new tag
        memmove(((unsigned char *)ph->tag + data_len), (unsigned char *)ph->tag, ntohs(ph->length));

diff --git a/drivers/net/wireless/rtl8812au/core/rtw_br_ext.c b/drivers/net/wireless/rtl8812au/core/rtw_br_ext.c
index 9a0effd..3ef6de1 100644 (file)
--- a/drivers/net/wireless/rtl8812au/core/rtw_br_ext.c
+++ b/drivers/net/wireless/rtl8812au/core/rtw_br_ext.c
@@ -110,6 +110,9 @@ static __inline__ int __nat25_add_pppoe_tag(struct sk_buff *skb, struct pppoe_ta
                return -1;
        }
 
+       if (data_len > 40)
+               data_len = 40;
+
        skb_put(skb, data_len);
        /* have a room for new tag */
        memmove(((unsigned char *)ph->tag + data_len), (unsigned char *)ph->tag, ntohs(ph->length));