summaryrefslogtreecommitdiff
path: root/drivers/staging/otus/ioctl.c
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2009-12-28 19:01:34 +0200
committerGreg Kroah-Hartman <gregkh@suse.de>2010-03-03 16:42:39 -0800
commit1c7e4a7c326c916918b5a29051db4f93973e775a (patch)
treec0da24d3c385086ba829e75235d0154441af0c76 /drivers/staging/otus/ioctl.c
parented30013207ef3e36da4f39db1298ae53f799e29c (diff)
Staging: otus: off by one in usbdrvwext_siwessid()
A 33 char ESSID is too long and it could cause a buffer overflow a couple lines below when we put a NULL terminator on the end. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/otus/ioctl.c')
-rw-r--r--drivers/staging/otus/ioctl.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/otus/ioctl.c b/drivers/staging/otus/ioctl.c
index 6808e69fb354..86d93330acad 100644
--- a/drivers/staging/otus/ioctl.c
+++ b/drivers/staging/otus/ioctl.c
@@ -930,7 +930,7 @@ int usbdrvwext_siwessid(struct net_device *dev,
return -EINVAL;
if (essid->flags == 1) {
- if (essid->length > (IW_ESSID_MAX_SIZE + 1))
+ if (essid->length > IW_ESSID_MAX_SIZE)
return -E2BIG;
if (copy_from_user(&EssidBuf, essid->pointer, essid->length))