From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kalle Valo Subject: Re: [PATCH] brcmfmac: fix wrong strnchr usage Date: Fri, 31 Aug 2018 15:48:18 +0000 (UTC) Message-ID: <20180831154818.9D0E96038E@smtp.codeaurora.org> References: <20180822132215.27669-1-linux@rasmusvillemoes.dk> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Cc: "David S. Miller" , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, Rasmus Villemoes To: Rasmus Villemoes Return-path: In-Reply-To: <20180822132215.27669-1-linux@rasmusvillemoes.dk> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org Rasmus Villemoes wrote: > strnchr takes arguments in the order of its name: string, max bytes to > read, character to search for. Here we're passing '\n' aka 10 as the > buffer size, and searching for sizeof(buf) aka BRCMF_DCMD_SMLEN aka > 256 (aka '\0', since it's implicitly converted to char) within those 10 > bytes. > > Just interchanging the last two arguments would still leave a bug, > because if we've been successful once, there are not sizeof(buf) > characters left after the new value of p. > > Since clmver is immediately afterwards passed as a %s argument, I assume > that it is actually a properly nul-terminated string. For that case, we > have strreplace(). > > Signed-off-by: Rasmus Villemoes Patch applied to wireless-drivers-next.git, thanks. cb18e2e9ec71 brcmfmac: fix wrong strnchr usage -- https://patchwork.kernel.org/patch/10572951/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches