From 354fd80768ac02bf9c5dc7556391cba73bc91b76 Mon Sep 17 00:00:00 2001 From: Srinivas Girigowda Date: Tue, 25 Aug 2020 09:50:09 -0700 Subject: [PATCH] qcacld-3.0: Avoid overflow of the output buffer The 2nd parameter to qdf_scnprintf() represents size of the buffer. If 'size' bytes is written in to the output buffer then for the next subsequent qdf_scnprintf() 'size' bytes must be substracted from the size of the output buffer. The problem in this code is, 2nd parameter is mentioned as PAGE_SIZE, but instead it should be PAGE_SIZE - size. Change-Id: I82c6b4a279eb912c693a4f026c2f672902ce3f76 CRs-Fixed: 2760078 --- components/ftm_time_sync/core/src/ftm_time_sync_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/ftm_time_sync/core/src/ftm_time_sync_main.c b/components/ftm_time_sync/core/src/ftm_time_sync_main.c index 9519363229bc..375196259b4c 100644 --- a/components/ftm_time_sync/core/src/ftm_time_sync_main.c +++ b/components/ftm_time_sync/core/src/ftm_time_sync_main.c @@ -401,7 +401,7 @@ ssize_t ftm_time_sync_show(struct wlan_objmgr_vdev *vdev, char *buf) q_master = vdev_priv->ftm_ts_priv.time_pair[iter].qtime_master; q_slave = vdev_priv->ftm_ts_priv.time_pair[iter].qtime_slave; - size += qdf_scnprintf(buf + size, PAGE_SIZE, + size += qdf_scnprintf(buf + size, PAGE_SIZE - size, "%s %llu %s %llu %s %lld\n", "Qtime_master", q_master, "Qtime_slave", q_slave, "Offset", q_slave > q_master ?