u32 data32;
u32 bytes;
u8 *ptmp;
+ int rv;
padapter = (struct adapter *)rtw_netdev_priv(dev);
p = &wrqu->data;
bytes = 0;
addr = 0;
- sscanf(ptmp, "%d,%x", &bytes, &addr);
+ rv = sscanf(ptmp, "%d,%x", &bytes, &addr);
+ if (rv != 2) {
+ kfree(ptmp);
+ return -EINVAL;
+ }
switch (bytes) {
case 1:
union iwreq_data *wrqu, char *extra)
{
struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
+ int rv;
u32 addr;
u32 data32;
bytes = 0;
addr = 0;
data32 = 0;
- sscanf(extra, "%d,%x,%x", &bytes, &addr, &data32);
+ rv = sscanf(extra, "%d,%x,%x", &bytes, &addr, &data32);
+ if (rv != 3)
+ return -EINVAL;
switch (bytes) {
case 1:
DBG_88E("[%s] extra = %s\n", __func__, extra);
if (!memcmp(extra, "lps =", 4)) {
- sscanf(extra+4, "%u", &mode);
+ ret = sscanf(extra+4, "%u", &mode);
+ if (ret != 1)
+ return -EINVAL;
ret = rtw_pm_set_lps(padapter, mode);
} else if (!memcmp(extra, "ips =", 4)) {
- sscanf(extra+4, "%u", &mode);
+ ret = sscanf(extra+4, "%u", &mode);
+ if (ret != 1)
+ return -EINVAL;
ret = rtw_pm_set_ips(padapter, mode);
} else {
ret = -EINVAL;
{
u32 bandwidth = 0, sg = 0;
struct adapter *padapter = rtw_netdev_priv(dev);
+ int rv;
- sscanf(extra, "40M =%d, shortGI =%d", &bandwidth, &sg);
+ rv = sscanf(extra, "40M =%d, shortGI =%d", &bandwidth, &sg);
+ if (rv != 2)
+ return -EINVAL;
if (bandwidth != HT_CHANNEL_WIDTH_40)
bandwidth = HT_CHANNEL_WIDTH_20;
u32 idx_a = 0, idx_b = 0;
char *input = kmalloc(wrqu->length, GFP_KERNEL);
struct adapter *padapter = rtw_netdev_priv(dev);
+ int rv;
if (!input)
return -ENOMEM;
kfree(input);
return -EFAULT;
}
- sscanf(input, "patha =%d, pathb =%d", &idx_a, &idx_b);
+ rv = sscanf(input, "patha =%d, pathb =%d", &idx_a, &idx_b);
+ if (rv != 2) {
+ kfree(input);
+ return -EINVAL;
+ }
sprintf(extra, "Set power level path_A:%d path_B:%d", idx_a, idx_b);
padapter->mppriv.txpoweridx = (u8)idx_a;
u32 pkTx = 1, countPkTx = 1, cotuTx = 1, CarrSprTx = 1, scTx = 1, sgleTx = 1, stop = 1;
u32 bStartTest = 1;
u32 count = 0;
+ int rv;
struct mp_priv *pmp_priv;
struct pkt_attrib *pattrib;
sgleTx = strncmp(extra, "background, stone", 20);
pkTx = strncmp(extra, "background, pkt", 20);
stop = strncmp(extra, "stop", 4);
- sscanf(extra, "count =%d, pkt", &count);
+ rv = sscanf(extra, "count =%d, pkt", &count);
+ if (rv != 2)
+ return -EINVAL;
_rtw_memset(extra, '\0', sizeof(*extra));
{
char *input = kmalloc(wrqu->length, GFP_KERNEL);
u32 valxcap;
+ int rv;
if (!input)
return -ENOMEM;
DBG_88E("%s:iwpriv in =%s\n", __func__, input);
- sscanf(input, "xcap =%d", &valxcap);
+ rv = sscanf(input, "xcap =%d", &valxcap);
+ if (rv != 1) {
+ kfree(input);
+ return -EINVAL;
+ }
kfree(input);
return 0;
s32 len;
u8 *extra = NULL;
u32 extra_size = 0;
+ int rv;
s32 k;
const iw_handler *priv; /* Private ioctl */
ptr = input;
len = input_len;
- sscanf(ptr, "%16s", cmdname);
+ rv = sscanf(ptr, "%16s", cmdname);
+ if (rv != 1) {
+ err = -EINVAL;
+ goto exit;
+ }
cmdlen = strlen(cmdname);
DBG_88E("%s: cmd =%s\n", __func__, cmdname);