Hello Hauke, Arend,
The patch 898d3c3b2462: "brcmsmac: use sprom from bcma" from Apr 29,
2012, leads to the following warning:
drivers/net/wireless/brcm80211/brcmsmac/channel.c:645
brcms_c_country_valid()
error: buffer overflow 'ccode' 2 <= 2
- if (ccode && brcms_c_country_valid(ccode))
- strncpy(wlc->pub->srom_ccode, ccode, BRCM_CNTRY_BUF_SZ - 1);
+ if (sprom->alpha2 && brcms_c_country_valid(sprom->alpha2))
^^^^^^^^^^^^^
This is a two character array. It's not NULL terminated.
+ strncpy(wlc->pub->srom_ccode, sprom->alpha2, sizeof(sprom->alpha2));
But in brcms_c_country_valid() we check for the NULL terminator.
637 static bool brcms_c_country_valid(const char *ccode)
638 {
639 /*
640 * only allow ascii alpha uppercase for the first 2
641 * chars.
642 */
643 if (!((0x80 & ccode[0]) == 0 && ccode[0] >= 0x41 && ccode[0] <= 0x5A &&
644 (0x80 & ccode[1]) == 0 && ccode[1] >= 0x41 && ccode[1] <= 0x5A &&
645 ccode[2] == '\0'))
^^^^^^^^^^^^^^^^
Here.
646 return false;
My guess is that this works because -> leddc_on_time is mostly zero.
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
