39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
|
From cb18e2e9ec71d42409a51b83546686c609780dde Mon Sep 17 00:00:00 2001
|
||
|
|
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
|
||
|
|
Date: Wed, 22 Aug 2018 15:22:15 +0200
|
||
|
|
Subject: [PATCH] brcmfmac: fix wrong strnchr usage
|
||
|
|
|
||
|
|
strnchr takes arguments in the order of its name: string, max bytes to
|
||
|
|
read, character to search for. Here we're passing '\n' aka 10 as the
|
||
|
|
buffer size, and searching for sizeof(buf) aka BRCMF_DCMD_SMLEN aka
|
||
|
|
256 (aka '\0', since it's implicitly converted to char) within those 10
|
||
|
|
bytes.
|
||
|
|
|
||
|
|
Just interchanging the last two arguments would still leave a bug,
|
||
|
|
because if we've been successful once, there are not sizeof(buf)
|
||
|
|
characters left after the new value of p.
|
||
|
|
|
||
|
|
Since clmver is immediately afterwards passed as a %s argument, I assume
|
||
|
|
that it is actually a properly nul-terminated string. For that case, we
|
||
|
|
have strreplace().
|
||
|
|
|
||
|
|
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
|
||
|
|
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||
|
|
---
|
||
|
|
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +---
|
||
|
|
1 file changed, 1 insertion(+), 3 deletions(-)
|
||
|
|
|
||
|
|
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
|
||
|
|
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
|
||
|
|
@@ -296,9 +296,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
|
||
|
|
/* Replace all newline/linefeed characters with space
|
||
|
|
* character
|
||
|
|
*/
|
||
|
|
- ptr = clmver;
|
||
|
|
- while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
|
||
|
|
- *ptr = ' ';
|
||
|
|
+ strreplace(clmver, '\n', ' ');
|
||
|
|
|
||
|
|
brcmf_dbg(INFO, "CLM version = %s\n", clmver);
|
||
|
|
}
|