Wireless Tools For Linux：

http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html

可以看到最新的稳定版本是v29，不过我在用的时候经常碰到这个错误：

[root@y root]# iwlist scanning
lo        Interface doesn't support scanning.

usb0      Interface doesn't support scanning.

print_scanning_info: Allocation failed

 

于是下载了29的源码，错误的出处：

 

realloc:
      /* (Re)allocate the buffer - realloc(NULL, len) == malloc(len) */
      newbuf = realloc(buffer, buflen);
      if(newbuf == NULL)
        {
          if(buffer)
        free(buffer);
          fprintf(stderr, "%s: Allocation failed\n", __FUNCTION__);
          return(-1);
        }
      buffer = newbuf;

      /* Try to read the results */
      wrq.u.data.pointer = buffer;
      wrq.u.data.flags = 0;
      wrq.u.data.length = buflen;
      if(iw_get_ext(skfd, ifname, SIOCGIWSCAN, &wrq) < 0)
        {
          /* Check if buffer was too small (WE-17 only) */
          if((errno == E2BIG) && (range.we_version_compiled > 16))
        {
          /* Some driver may return very large scan results, either
           * because there are many cells, or because they have many
           * large elements in cells (like IWEVCUSTOM). Most will
           * only need the regular sized buffer. We now use a dynamic
           * allocation of the buffer to satisfy everybody. Of course,
           * as we don't know in advance the size of the array, we try
           * various increasing sizes. Jean II */

          /* Check if the driver gave us any hints. */
          if(wrq.u.data.length > buflen)
            buflen = wrq.u.data.length;
          else
            buflen *= 2;

          /* Try again */
          goto realloc;
        }
E2BIG错误发出后，会修改要realloc的内存块长度
buflen*=2
就很让人费解了，加入了些打印消息后编译了下发现，length=0时也会发出E2BIG的errno，很让人费解，不过以自己目前的知识积累，没法继续研究下去了。
试着修改了下，修改的过程中，发现了最开始的网址的这么一块：
image
slightly bigger scan buffer
于是下载了该版本看了下，相关处已经改成了：
realloc:
      /* (Re)allocate the buffer - realloc(NULL, len) == malloc(len) */
      newbuf = realloc(buffer, buflen);
      if(newbuf == NULL)
        {
          if(buffer)
        free(buffer);
          fprintf(stderr, "%s: Allocation failed\n", __FUNCTION__);
          return(-1);
        }
      buffer = newbuf;

      /* Try to read the results */
      wrq.u.data.pointer = buffer;
      wrq.u.data.flags = 0;
      wrq.u.data.length = buflen;
      if(iw_get_ext(skfd, ifname, SIOCGIWSCAN, &wrq) < 0)
        {
          /* Check if buffer was too small (WE-17 only) */
          if((errno == E2BIG) && (range.we_version_compiled > 16)
         && (buflen < 0xFFFF))
        {
          /* Some driver may return very large scan results, either
           * because there are many cells, or because they have many
           * large elements in cells (like IWEVCUSTOM). Most will
           * only need the regular sized buffer. We now use a dynamic
           * allocation of the buffer to satisfy everybody. Of course,
           * as we don't know in advance the size of the array, we try
           * various increasing sizes. Jean II */

          /* Check if the driver gave us any hints. */
          if(wrq.u.data.length > buflen)
            buflen = wrq.u.data.length;
          else
            buflen *= 2;

          /* wrq.u.data.length is 16 bits so max size is 65535 */
          if(buflen > 0xFFFF)
            buflen = 0xFFFF;

          /* Try again */
          goto realloc;
        }

。

不过这里出错时，所得的buffer是空字符串，而不是截断的字符串，所以用处不大，对自己用处不大。o(╯□╰)o

做个记录，深感自己的知识积累太少，平时没事拿过这种代码来就该学习下。