From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753741AbbCBI0K (ORCPT ); Mon, 2 Mar 2015 03:26:10 -0500 Received: from wolverine02.qualcomm.com ([199.106.114.251]:58585 "EHLO wolverine02.qualcomm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753299AbbCBIZD (ORCPT ); Mon, 2 Mar 2015 03:25:03 -0500 X-IronPort-AV: E=McAfee;i="5600,1067,7727"; a="197825192" From: Vladimir Kondratiev X-IronPort-AV: E=Sophos;i="5.09,674,1418112000"; d="scan'208";a="851606602" Message-ID: <54F41E4F.8090502@qca.qualcomm.com> Date: Mon, 2 Mar 2015 10:24:47 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Colin King , Kalle Valo , , , CC: Subject: Re: [PATCH] wil6210: increase cmd buffer size to avoid sscanf buffer overflow References: <1425232113-5010-1-git-send-email-colin.king@canonical.com> In-Reply-To: <1425232113-5010-1-git-send-email-colin.king@canonical.com> Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: NASANEXM01C.na.qualcomm.com (10.85.0.83) To NASANEXM01E.na.qualcomm.com (10.85.0.31) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/01/2015 07:48 PM, Colin King wrote: > From: Colin Ian King > > cppcheck detected a buffer overflow: > > [drivers/net/wireless/ath/wil6210/debugfs.c:634]: (error) Width 8 > given in format string (no. 1) is larger than destination buffer > 'cmd[8]', use %7s to prevent overflowing it. > > For the current %8s sscanf we require cmd to be 9 chars long > so increase it by 1 byte to prevent the sscan overflow (rather > than reduce the %8s specifier to %7s as cppcheck recommends). > > Signed-off-by: Colin Ian King > --- > drivers/net/wireless/ath/wil6210/debugfs.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c > index 45c3558e..29aab12 100644 > --- a/drivers/net/wireless/ath/wil6210/debugfs.c > +++ b/drivers/net/wireless/ath/wil6210/debugfs.c > @@ -618,7 +618,7 @@ static ssize_t wil_write_back(struct file *file, const char __user *buf, > struct wil6210_priv *wil = file->private_data; > int rc; > char *kbuf = kmalloc(len + 1, GFP_KERNEL); > - char cmd[8]; > + char cmd[9]; > int p1, p2, p3; > > if (!kbuf) > Thanks for finding this. Here is my Acked-by: Vladimir Kondratiev Thanks, Vladimir