| 1234567891011121314151617181920212223242526272829303132333435363738 |
- From cb18e2e9ec71d42409a51b83546686c609780dde Mon Sep 17 00:00:00 2001
- From: Rasmus Villemoes <[email protected]>
- Date: Wed, 22 Aug 2018 15:22:15 +0200
- Subject: [PATCH] brcmfmac: fix wrong strnchr usage
- strnchr takes arguments in the order of its name: string, max bytes to
- read, character to search for. Here we're passing '\n' aka 10 as the
- buffer size, and searching for sizeof(buf) aka BRCMF_DCMD_SMLEN aka
- 256 (aka '\0', since it's implicitly converted to char) within those 10
- bytes.
- Just interchanging the last two arguments would still leave a bug,
- because if we've been successful once, there are not sizeof(buf)
- characters left after the new value of p.
- Since clmver is immediately afterwards passed as a %s argument, I assume
- that it is actually a properly nul-terminated string. For that case, we
- have strreplace().
- Signed-off-by: Rasmus Villemoes <[email protected]>
- Signed-off-by: Kalle Valo <[email protected]>
- ---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
- --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
- +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
- @@ -296,9 +296,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- /* Replace all newline/linefeed characters with space
- * character
- */
- - ptr = clmver;
- - while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
- - *ptr = ' ';
- + strreplace(clmver, '\n', ' ');
-
- brcmf_dbg(INFO, "CLM version = %s\n", clmver);
- }
|
