diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2011-11-21 17:47:13 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-11-21 14:45:21 -0500 |
| commit | 40f9cd299a0e5e8dcdde9b5eb9bfda1cb9109f61 (patch) | |
| tree | a189d20c2e6d6cff59d5d86eea065ba22a980f6b | |
| parent | de3584bd62d87b4c250129fbc46ca52c80330add (diff) | |
prism54: potential memory corruption in prism54_get_essid()
"dwrq->length" is the capped version of "essid->length".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/prism54/isl_ioctl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c index d97a2caf582b..bc2ba80c47bb 100644 --- a/drivers/net/wireless/prism54/isl_ioctl.c +++ b/drivers/net/wireless/prism54/isl_ioctl.c @@ -778,7 +778,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info, dwrq->flags = 0; dwrq->length = 0; } - essid->octets[essid->length] = '\0'; + essid->octets[dwrq->length] = '\0'; memcpy(extra, essid->octets, dwrq->length); kfree(essid); |