From: Jouni Malinen <quic_jouni@quicinc.com>
Date: Wed, 1 Mar 2023 08:38:02 +0000 (+0200)
Subject: nl80211: Make sure scan frequency debug buffer is NUL terminated
X-Git-Tag: hostap_2_11~1260
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f628e6b30e950963ac55232630e30d398d4badc7;p=thirdparty%2Fhostap.git

nl80211: Make sure scan frequency debug buffer is NUL terminated

In theory, os_snprintf() could have filled the buffer to the end and
while the pos variable would not have been incremented beyond that,
there would not necessarily be a NUL termination at the end. Force the
array to end in NUL just in case.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
---

diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
index 3a2faf63e..cf31552c0 100644
--- a/src/drivers/driver_nl80211_event.c
+++ b/src/drivers/driver_nl80211_event.c
@@ -1737,6 +1737,7 @@ static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
 		}
 		info->freqs = freqs;
 		info->num_freqs = num_freqs;
+		msg[sizeof(msg) - 1] = '\0';
 		wpa_printf(MSG_DEBUG, "nl80211: Scan included frequencies:%s",
 			   msg);
 	}