2013-01-24 06:40:26

by Dan Carpenter

Subject: [patch] cfg80211: off by one in ieee80211_bss()

We do a:

sprintf(buf, " Last beacon: %ums ago",
elapsed_jiffies_msecs(bss->ts));

elapsed_jiffies_msecs() can return a 10 digit number so "buf" needs to
be 31 characters long.

Signed-off-by: Dan Carpenter <[email protected]>

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 01592d7..45f1618 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1358,7 +1358,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
&iwe, IW_EV_UINT_LEN);
}

- buf = kmalloc(30, GFP_ATOMIC);
+ buf = kmalloc(31, GFP_ATOMIC);
if (buf) {
memset(&iwe, 0, sizeof(iwe));
iwe.cmd = IWEVCUSTOM;

2013-01-24 14:47:24

by Johannes Berg

Subject: Re: [patch] cfg80211: off by one in ieee80211_bss()

On Thu, 2013-01-24 at 09:40 +0300, Dan Carpenter wrote:
> We do a:
>
> sprintf(buf, " Last beacon: %ums ago",
> elapsed_jiffies_msecs(bss->ts));
>
> elapsed_jiffies_msecs() can return a 10 digit number so "buf" needs to
> be 31 characters long.

Applied, thanks.

johannes

2013-01-24 07:29:34

by Luciano Coelho

Subject: Re: [patch] cfg80211: off by one in ieee80211_bss()

On Thu, 2013-01-24 at 09:40 +0300, Dan Carpenter wrote:
> We do a:
>
> sprintf(buf, " Last beacon: %ums ago",
> elapsed_jiffies_msecs(bss->ts));
>
> elapsed_jiffies_msecs() can return a 10 digit number so "buf" needs to
> be 31 characters long.
>
> Signed-off-by: Dan Carpenter <[email protected]>
>
> diff --git a/net/wireless/scan.c b/net/wireless/scan.c
> index 01592d7..45f1618 100644
> --- a/net/wireless/scan.c
> +++ b/net/wireless/scan.c
> @@ -1358,7 +1358,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
> &iwe, IW_EV_UINT_LEN);
> }
>
> - buf = kmalloc(30, GFP_ATOMIC);
> + buf = kmalloc(31, GFP_ATOMIC);
> if (buf) {
> memset(&iwe, 0, sizeof(iwe));
> iwe.cmd = IWEVCUSTOM;

Looks good. Also, to be on the safe side, shouldn't snprintf be used
when writing to buf as well? Same thing higher up where the same buf is
used and alloc'ed 50 bytes...

--
Luca.