[PATCH] wireless: More WE-21 potential overflows...
After the Orinoco issue, I did an audit of other drivers for the same issue. Three drivers were NULL terminating the ESSID, which could cause an overflow in WE-21 when the ESSID has maximum size. Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
683f8c9e00
commit
53077944f1
|
@ -5970,7 +5970,6 @@ static int airo_get_essid(struct net_device *dev,
|
|||
|
||||
/* Get the current SSID */
|
||||
memcpy(extra, status_rid.SSID, status_rid.SSIDlen);
|
||||
extra[status_rid.SSIDlen] = '\0';
|
||||
/* If none, we may want to get the one that was set */
|
||||
|
||||
/* Push it out ! */
|
||||
|
|
|
@ -1678,11 +1678,9 @@ static int atmel_get_essid(struct net_device *dev,
|
|||
/* Get the current SSID */
|
||||
if (priv->new_SSID_size != 0) {
|
||||
memcpy(extra, priv->new_SSID, priv->new_SSID_size);
|
||||
extra[priv->new_SSID_size] = '\0';
|
||||
dwrq->length = priv->new_SSID_size;
|
||||
} else {
|
||||
memcpy(extra, priv->SSID, priv->SSID_size);
|
||||
extra[priv->SSID_size] = '\0';
|
||||
dwrq->length = priv->SSID_size;
|
||||
}
|
||||
|
||||
|
|
|
@ -1198,7 +1198,6 @@ static int ray_get_essid(struct net_device *dev,
|
|||
|
||||
/* Get the essid that was set */
|
||||
memcpy(extra, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);
|
||||
extra[IW_ESSID_MAX_SIZE] = '\0';
|
||||
|
||||
/* Push it out ! */
|
||||
dwrq->length = strlen(extra);
|
||||
|
|
Loading…
Reference in a new issue