From 41d23254b902945df9bd759afb5f72a6f6056c53 Mon Sep 17 00:00:00 2001 From: Avraham Stern Date: Tue, 28 Feb 2023 13:10:01 +0200 Subject: [PATCH] nl80211: Fix frequencies array boundary check for scanned frequencies The number of frequencies is increased before the boundary check, thus it should be allowed to be equal to the number of elements in the array. Update the limit to allow the full array to be used. In addition, add the missing byte for the NULL terminator for the debug print to be able to fit all values (assuming they are <= 9999 MHz). Signed-off-by: Avraham Stern --- src/drivers/driver_nl80211_event.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c index e3fcb4402..3a2faf63e 100644 --- a/src/drivers/driver_nl80211_event.c +++ b/src/drivers/driver_nl80211_event.c @@ -1717,7 +1717,7 @@ static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted, } } if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) { - char msg[MAX_REPORT_FREQS * 5], *pos, *end; + char msg[MAX_REPORT_FREQS * 5 + 1], *pos, *end; int res; pos = msg; @@ -1732,7 +1732,7 @@ static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted, if (!os_snprintf_error(end - pos, res)) pos += res; num_freqs++; - if (num_freqs == MAX_REPORT_FREQS - 1) + if (num_freqs == MAX_REPORT_FREQS) break; } info->freqs = freqs; -- 2.47.3