commit 826d94196d9b4c9eec96f1149aebeb2d5f24836e
author Arif Hussain <c_arifh@qca.qualcomm.com> Tue Nov 12 16:44:54 2013 -0800
committer Kiet Lam <c_kietl@qca.qualcomm.com> Sat Nov 16 16:51:22 2013 -0800
tree 6259a373259ae50077afaf4e91b026aa3086a212
parent a47e992c5bd732a8d6dc9ac9fa40c5b0a4acab3e

wlan: Fix buffer Overread in hdd_ioctl

snprintf can return more than the size of buffer
using scnprintf rather than snprintf.

Change-Id: I987ee80c1fac4fc9fce1388aabc334e398ca47df
CRs-Fixed:  553421

CORE/HDD/src/wlan_hdd_main.c

diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index d759d09..21b240f 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -2732,7 +2732,7 @@
            char extra[32];
            tANI_U8 len = 0;
 
-           len = snprintf(extra, sizeof(extra), "%s %d", command, wesMode);
+           len = scnprintf(extra, sizeof(extra), "%s %d", command, wesMode);
            if (copy_to_user(priv_data.buf, &extra, len + 1))
            {
                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
@@ -3220,7 +3220,7 @@
               goto exit;
            }
 
-           len = snprintf(extra, sizeof(extra), "WLS_BATCHING_VERSION %d",
+           len = scnprintf(extra, sizeof(extra), "WLS_BATCHING_VERSION %d",
                    version);
            if (copy_to_user(priv_data.buf, &extra, len + 1))
            {