From edcd418b475f7759aa2aaa628df7b4c6a66040ae Mon Sep 17 00:00:00 2001
From: Dan Carpenter <error27@gmail.com>
Date: Wed, 9 Feb 2011 01:45:13 +0300
Subject: [PATCH] --- yaml --- r: 235871 b: refs/heads/master c:
 d936435f2082788748ae5783cf2c006367d04bb8 h: refs/heads/master i:   235869:
 9b787644bedc2decbd8a28243b4823dcdf42b323   235867:
 519785b8d5f86af80c75644c0fe04f895265ddc7   235863:
 0299b6d80dde0e00228057df614f6cadda141563   235855:
 c189bd09aa5260022543d40db35615af1921f6e7   235839:
 8f774e589d62e98abaddfafd0aedf60fddbba9e2 v: v3

---
 [refs]                                        |  2 +-
 .../staging/rtl8712/rtl871x_ioctl_linux.c     | 22 +++++++++++--------
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/[refs] b/[refs]
index db747b9f6f9a..ba112fffbf5d 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: ec42dc2c7f6a530d16562a061cb3d00a63f8a612
+refs/heads/master: d936435f2082788748ae5783cf2c006367d04bb8
diff --git a/trunk/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/trunk/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
index 0d288c159c1d..221be81c85eb 100644
--- a/trunk/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ b/trunk/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
@@ -281,18 +281,20 @@ static inline char *translate_scan(struct _adapter *padapter,
 	/* parsing WPA/WPA2 IE */
 	{
 		u16 wpa_len = 0, rsn_len = 0;
-		u8 *p;
+		int n;
 		sint out_len = 0;
 		out_len = r8712_get_sec_ie(pnetwork->network.IEs,
 					   pnetwork->network.
 					   IELength, rsn_ie, &rsn_len,
 					   wpa_ie, &wpa_len);
 		if (wpa_len > 0) {
-			p = buf;
 			memset(buf, 0, MAX_WPA_IE_LEN);
-			p += snprintf(p, 7, "wpa_ie=");
-			for (i = 0; i < wpa_len; i++)
-				p += snprintf(p, 2, "%02x", wpa_ie[i]);
+			n = sprintf(buf, "wpa_ie=");
+			for (i = 0; i < wpa_len; i++) {
+				n += snprintf(buf + n, MAX_WPA_IE_LEN - n, "%02x", wpa_ie[i]);
+				if (n >= MAX_WPA_IE_LEN)
+					break;
+			}
 			memset(&iwe, 0, sizeof(iwe));
 			iwe.cmd = IWEVCUSTOM;
 			iwe.u.data.length = (u16)strlen(buf);
@@ -305,11 +307,13 @@ static inline char *translate_scan(struct _adapter *padapter,
 				&iwe, wpa_ie);
 		}
 		if (rsn_len > 0) {
-			p = buf;
 			memset(buf, 0, MAX_WPA_IE_LEN);
-			p += snprintf(p, 7, "rsn_ie=");
-			for (i = 0; i < rsn_len; i++)
-				p += snprintf(p, 2, "%02x", rsn_ie[i]);
+			n = sprintf(buf, "rsn_ie=");
+			for (i = 0; i < rsn_len; i++) {
+				n += snprintf(buf + n, MAX_WPA_IE_LEN - n, "%02x", rsn_ie[i]);
+				if (n >= MAX_WPA_IE_LEN)
+					break;
+			}
 			memset(&iwe, 0, sizeof(iwe));
 			iwe.cmd = IWEVCUSTOM;
 			iwe.u.data.length = strlen(buf);