summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2011-11-21 15:47:13 +0100
committerJohn W. Linville <linville@tuxdriver.com>2011-11-21 20:45:21 +0100
commit40f9cd299a0e5e8dcdde9b5eb9bfda1cb9109f61 (patch)
treea189d20c2e6d6cff59d5d86eea065ba22a980f6b
parentcfg80211: fix regulatory NULL dereference (diff)
downloadlinux-40f9cd299a0e5e8dcdde9b5eb9bfda1cb9109f61.tar.xz
linux-40f9cd299a0e5e8dcdde9b5eb9bfda1cb9109f61.zip
prism54: potential memory corruption in prism54_get_essid()
"dwrq->length" is the capped version of "essid->length". Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--drivers/net/wireless/prism54/isl_ioctl.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index d97a2caf582b..bc2ba80c47bb 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -778,7 +778,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
dwrq->flags = 0;
dwrq->length = 0;
}
- essid->octets[essid->length] = '\0';
+ essid->octets[dwrq->length] = '\0';
memcpy(extra, essid->octets, dwrq->length);
kfree(essid);