]> asedeno.scripts.mit.edu Git - linux.git/commitdiff
ath10k: avoid possible string overflow
authorArnd Bergmann <arnd@arndb.de>
Wed, 28 Mar 2018 22:06:10 +0000 (00:06 +0200)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 10 Apr 2018 14:27:52 +0000 (17:27 +0300)
The way that 'strncat' is used here raised a warning in gcc-8:

drivers/net/wireless/ath/ath10k/wmi.c: In function 'ath10k_wmi_tpc_stats_final_disp_tables':
drivers/net/wireless/ath/ath10k/wmi.c:4649:4: error: 'strncat' output truncated before terminating nul copying as many bytes from a string as its length [-Werror=stringop-truncation]

Effectively, this is simply a strcat() but the use of strncat() suggests
some form of overflow check. Regardless of whether this might actually
overflow, using strlcat() instead of strncat() avoids the warning and
makes the code more robust.

Fixes: bc64d05220f3 ("ath10k: debugfs support to get final TPC stats for 10.4 variants")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/ath/ath10k/wmi.c

index c5e1ca5945db79dd8b9d0a37559011d998b9595e..80a80830b3631119e128a8050a32c13336fddba8 100644 (file)
@@ -4357,7 +4357,7 @@ static void ath10k_tpc_config_disp_tables(struct ath10k *ar,
                                                            rate_code[i],
                                                            type);
                        snprintf(buff, sizeof(buff), "%8d ", tpc[j]);
-                       strncat(tpc_value, buff, strlen(buff));
+                       strlcat(tpc_value, buff, sizeof(tpc_value));
                }
                tpc_stats->tpc_table[type].pream_idx[i] = pream_idx;
                tpc_stats->tpc_table[type].rate_code[i] = rate_code[i];
@@ -4694,7 +4694,7 @@ ath10k_wmi_tpc_stats_final_disp_tables(struct ath10k *ar,
                                                               rate_code[i],
                                                               type, pream_idx);
                        snprintf(buff, sizeof(buff), "%8d ", tpc[j]);
-                       strncat(tpc_value, buff, strlen(buff));
+                       strlcat(tpc_value, buff, sizeof(tpc_value));
                }
                tpc_stats->tpc_table_final[type].pream_idx[i] = pream_idx;
                tpc_stats->tpc_table_final[type].rate_code[i] = rate_code[i];