summaryrefslogtreecommitdiff
path: root/drivers/staging
diff options
context:
space:
mode:
authorDan Aloni <dan@aloni.org>2009-06-24 22:34:39 +0300
committerGreg Kroah-Hartman <gregkh@suse.de>2009-07-12 13:21:45 -0700
commit91fca6da389b897483b4c1edea29885172989fda (patch)
tree750c7f198301660c028f09264f361f4edb16de3d /drivers/staging
parent02c8baecf5d8850dba40b47cdf003ed2e04e66dd (diff)
Staging: prevent rtl8192su from crashing dev_ioctl in SIOCGIWNAME
(adapted from the rtl8187se patch) ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and on certain conditions, the concatenated string will be larger than IFNAMSIZ including the terminating zero. length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17 This fix uses strl{cpy,cat} in addition to the reduction of the total possible length of the output string by a char. It can be applied to 2.6.30-stable as well. Signed-off-by: Dan Aloni <dan@aloni.org> Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging')
-rw-r--r--drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c14
1 files changed, 7 insertions, 7 deletions
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
index 1f50c46dcb90..191dc3fbbe32 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
@@ -548,21 +548,21 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
struct iw_request_info *info,
union iwreq_data *wrqu, char *extra)
{
- strcpy(wrqu->name, "802.11");
+ strlcpy(wrqu->name, "802.11", IFNAMSIZ);
if(ieee->modulation & IEEE80211_CCK_MODULATION){
- strcat(wrqu->name, "b");
+ strlcat(wrqu->name, "b", IFNAMSIZ);
if(ieee->modulation & IEEE80211_OFDM_MODULATION)
- strcat(wrqu->name, "/g");
+ strlcat(wrqu->name, "/g", IFNAMSIZ);
}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
- strcat(wrqu->name, "g");
+ strlcat(wrqu->name, "g", IFNAMSIZ);
if (ieee->mode & (IEEE_N_24G | IEEE_N_5G))
- strcat(wrqu->name, "/n");
+ strlcat(wrqu->name, "/n", IFNAMSIZ);
if((ieee->state == IEEE80211_LINKED) ||
(ieee->state == IEEE80211_LINKED_SCANNING))
- strcat(wrqu->name," linked");
+ strlcat(wrqu->name, " link", IFNAMSIZ);
else if(ieee->state != IEEE80211_NOLINK)
- strcat(wrqu->name," link..");
+ strlcat(wrqu->name, " .....", IFNAMSIZ);
return 0;