diff options
author | Colin Ian King <colin.king@canonical.com> | 2015-03-01 12:48:33 -0500 |
---|---|---|
committer | Kalle Valo <kvalo@codeaurora.org> | 2015-03-03 08:48:12 -0500 |
commit | 2a19f7765bd90a56f3916a603e25b57b3b087480 (patch) | |
tree | ca6c3a2b98ce3b24154dfc5cda0cb6af4c08cf37 /drivers | |
parent | 6e6dd08dd3202d735143c973b888572955603391 (diff) |
wil6210: increase cmd buffer size to avoid sscanf buffer overflow
cppcheck detected a buffer overflow:
[drivers/net/wireless/ath/wil6210/debugfs.c:634]: (error) Width 8
given in format string (no. 1) is larger than destination buffer
'cmd[8]', use %7s to prevent overflowing it.
For the current %8s sscanf we require cmd to be 9 chars long
so increase it by 1 byte to prevent the sscan overflow (rather
than reduce the %8s specifier to %7s as cppcheck recommends).
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/net/wireless/ath/wil6210/debugfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c index fbe27a34e146..3830cc20d4fa 100644 --- a/drivers/net/wireless/ath/wil6210/debugfs.c +++ b/drivers/net/wireless/ath/wil6210/debugfs.c | |||
@@ -626,7 +626,7 @@ static ssize_t wil_write_back(struct file *file, const char __user *buf, | |||
626 | struct wil6210_priv *wil = file->private_data; | 626 | struct wil6210_priv *wil = file->private_data; |
627 | int rc; | 627 | int rc; |
628 | char *kbuf = kmalloc(len + 1, GFP_KERNEL); | 628 | char *kbuf = kmalloc(len + 1, GFP_KERNEL); |
629 | char cmd[8]; | 629 | char cmd[9]; |
630 | int p1, p2, p3; | 630 | int p1, p2, p3; |
631 | 631 | ||
632 | if (!kbuf) | 632 | if (!kbuf) |