package/kernel/mac80211/patches/brcm/302-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch

   1 From cb18e2e9ec71d42409a51b83546686c609780dde Mon Sep 17 00:00:00 2001
   2 From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
   3 Date: Wed, 22 Aug 2018 15:22:15 +0200
   4 Subject: [PATCH] brcmfmac: fix wrong strnchr usage
   5
   6 strnchr takes arguments in the order of its name: string, max bytes to
   7 read, character to search for. Here we're passing '\n' aka 10 as the
   8 buffer size, and searching for sizeof(buf) aka BRCMF_DCMD_SMLEN aka
   9 256 (aka '\0', since it's implicitly converted to char) within those 10
  10 bytes.
  11
  12 Just interchanging the last two arguments would still leave a bug,
  13 because if we've been successful once, there are not sizeof(buf)
  14 characters left after the new value of p.
  15
  16 Since clmver is immediately afterwards passed as a %s argument, I assume
  17 that it is actually a properly nul-terminated string. For that case, we
  18 have strreplace().
  19
  20 Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
  21 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  22 ---
  23  drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +---
  24  1 file changed, 1 insertion(+), 3 deletions(-)
  25
  26 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
  27 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
  28 @@ -296,9 +296,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
  29                 /* Replace all newline/linefeed characters with space
  30                  * character
  31                  */
  32 -               ptr = clmver;
  33 -               while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
  34 -                       *ptr = ' ';
  35 +               strreplace(clmver, '\n', ' ');
  36
  37                 brcmf_dbg(INFO, "CLM version = %s\n", clmver);
  38         }