staging: rtl8192e: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311092451.23933-3-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8192e/rtllib_rx.c b/drivers/staging/rtl8192e/rtllib_rx.c
index 0bae0a0a4cbe1a9d3ea1ef78ba8117f2b0522f07..d31b5e1c8df479f6945e77330c74a5bdefdd27b7 100644 (file)
--- a/drivers/staging/rtl8192e/rtllib_rx.c
+++ b/drivers/staging/rtl8192e/rtllib_rx.c
@@ -2092,7 +2092,7 @@ int rtllib_parse_info_param(struct rtllib_device *ieee,
                                                 MAX_RATES_LENGTH);
                        for (i = 0; i < network->rates_len; i++) {
                                network->rates[i] = info_element->data[i];
-                               p += snprintf(p, sizeof(rates_str) -
+                               p += scnprintf(p, sizeof(rates_str) -
                                              (p - rates_str), "%02X ",
                                              network->rates[i]);
                                if (rtllib_is_ofdm_rate
@@ -2120,7 +2120,7 @@ int rtllib_parse_info_param(struct rtllib_device *ieee,
                                                    MAX_RATES_EX_LENGTH);
                        for (i = 0; i < network->rates_ex_len; i++) {
                                network->rates_ex[i] = info_element->data[i];
-                               p += snprintf(p, sizeof(rates_str) -
+                               p += scnprintf(p, sizeof(rates_str) -
                                              (p - rates_str), "%02X ",
                                              network->rates_ex[i]);
                                if (rtllib_is_ofdm_rate

diff --git a/drivers/staging/rtl8192e/rtllib_wx.c b/drivers/staging/rtl8192e/rtllib_wx.c
index beb40967936a17bbdb7faae6de7ad328b6a12224..7e7df50164fb13944aa8f3ca72e48ad43b2a2bc2 100644 (file)
--- a/drivers/staging/rtl8192e/rtllib_wx.c
+++ b/drivers/staging/rtl8192e/rtllib_wx.c
@@ -114,7 +114,7 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee,
        /* Add basic and extended rates */
        max_rate = 0;
        p = custom;
-       p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
+       p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
        for (i = 0, j = 0; i < network->rates_len;) {
                if (j < network->rates_ex_len &&
                    ((network->rates_ex[j] & 0x7F) <
@@ -124,12 +124,12 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee,
                        rate = network->rates[i++] & 0x7F;
                if (rate > max_rate)
                        max_rate = rate;
-               p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+               p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),
                              "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
        }
        for (; j < network->rates_ex_len; j++) {
                rate = network->rates_ex[j] & 0x7F;
-               p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+               p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),
                              "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
                if (rate > max_rate)
                        max_rate = rate;
@@ -226,7 +226,7 @@ static inline char *rtl819x_translate_scan(struct rtllib_device *ieee,
         */
        iwe.cmd = IWEVCUSTOM;
        p = custom;
-       p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+       p += scnprintf(p, MAX_CUSTOM_LEN - (p - custom),
                      " Last beacon: %lums ago",
                      (jiffies - network->last_scanned) / (HZ / 100));
        iwe.u.data.length = p - custom;