Index: pcap-usb-linux.c =================================================================== RCS file: /tcpdump/master/libpcap/pcap-usb-linux.c,v retrieving revision 1.16 diff -u -p -r1.16 pcap-usb-linux.c --- pcap-usb-linux.c 14 Sep 2007 01:55:49 -0000 1.16 +++ pcap-usb-linux.c 30 Nov 2007 08:15:17 -0000 @@ -29,6 +29,7 @@ * * USB sniffing API implementation for Linux platform * By Paolo Abeni + * Modifications: Kris Katterjohn * */ #ifndef lint @@ -528,8 +529,15 @@ usb_stats_linux(pcap_t *handle, struct p /* extract info on dropped urbs */ for (consumed=0; consumed < ret; ) { + /* from the sscanf man page: + * The C standard says: "Execution of a %n directive does + * not increment the assignment count returned at the completion + * of execution" but the Corrigendum seems to contradict this. + * Do not make any assumptions on the effect of %n conversions + * on the return value and explicitly check for cnt assignmet*/ + cnt = -1; int ntok = sscanf(ptr, "%s%n", token, &cnt); - if (ntok != 2) + if ((ntok < 1) || (cnt < 0)) break; consumed += cnt; ptr += cnt; @@ -537,7 +545,7 @@ usb_stats_linux(pcap_t *handle, struct p ret = sscanf(ptr, "%d", &stats->ps_drop); else ret = sscanf(ptr, "%d", &dummy); - if (ntok != 2) + if (ntok != 1) break; consumed += cnt; ptr += cnt;