wireless: airo: potential buffer overflow in sprintf()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 24 Oct 2018 08:33:34 +0000 (11:33 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 28 Nov 2019 17:28:57 +0000 (18:28 +0100)
commitd7253cb7c57fe7ca56e4afbea9aa6c8505260ebd
tree9026824511829b479c55afbb5dcd84350cfff923
parent4b3a1f75e29da548d0c52e3322b51f21e2a1d3c1
wireless: airo: potential buffer overflow in sprintf()

[ Upstream commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac ]

It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
(precision) so if the ssid doesn't have a NUL terminator this could lead
to an overflow.

Static analysis.  Not tested.

Fixes: e174961ca1a0 ("net: convert print_mac to %pM")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/cisco/airo.c