Jelajahi Sumber

qcacld-3.0: Avoid overflow of the output buffer

The 2nd parameter to qdf_scnprintf() represents size of the buffer.
If 'size' bytes is written in to the output buffer then for the next
subsequent qdf_scnprintf() 'size' bytes must be substracted from the
size of the output buffer.

The problem in this code is, 2nd parameter is mentioned as PAGE_SIZE,
but instead it should be PAGE_SIZE - size.

Change-Id: I82c6b4a279eb912c693a4f026c2f672902ce3f76
CRs-Fixed: 2760078
Srinivas Girigowda 4 tahun lalu
induk
melakukan
354fd80768
1 mengubah file dengan 1 tambahan dan 1 penghapusan
  1. 1 1
      components/ftm_time_sync/core/src/ftm_time_sync_main.c

+ 1 - 1
components/ftm_time_sync/core/src/ftm_time_sync_main.c

@@ -401,7 +401,7 @@ ssize_t ftm_time_sync_show(struct wlan_objmgr_vdev *vdev, char *buf)
 		q_master = vdev_priv->ftm_ts_priv.time_pair[iter].qtime_master;
 		q_slave = vdev_priv->ftm_ts_priv.time_pair[iter].qtime_slave;
 
-		size += qdf_scnprintf(buf + size, PAGE_SIZE,
+		size += qdf_scnprintf(buf + size, PAGE_SIZE - size,
 				      "%s %llu %s %llu %s %lld\n",
 				      "Qtime_master", q_master, "Qtime_slave",
 				      q_slave, "Offset", q_slave > q_master ?