diff options
| author | Larry Finger | 2012-11-27 19:08:44 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2012-11-28 17:49:21 +0100 |
| commit | 8b7a13c3f404cbd26b495fa9c34339cb9b7b8164 (patch) | |
| tree | 52ad2d0b5f1342665b867e9be00ea3f4ed175cde /drivers/staging/rtl8712 | |
| parent | staging: gdm72xx: use %pI4 format to print IPv4 address and remove last usage... (diff) | |
| download | kernel-qcow2-linux-8b7a13c3f404cbd26b495fa9c34339cb9b7b8164.tar.gz kernel-qcow2-linux-8b7a13c3f404cbd26b495fa9c34339cb9b7b8164.tar.xz kernel-qcow2-linux-8b7a13c3f404cbd26b495fa9c34339cb9b7b8164.zip | |
staging: r8712u: Fix possible buffer overrun
In routine r8712_report_sec_ie(), the code could set the length
of the buffer to 256; however, that value is one larger than the
corresponding memory allocation.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/rtl8712')
| -rw-r--r-- | drivers/staging/rtl8712/mlme_linux.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/rtl8712/mlme_linux.c b/drivers/staging/rtl8712/mlme_linux.c index abf96c14df93..7279854c86aa 100644 --- a/drivers/staging/rtl8712/mlme_linux.c +++ b/drivers/staging/rtl8712/mlme_linux.c @@ -156,7 +156,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie) p = buff; p += sprintf(p, "ASSOCINFO(ReqIEs="); len = sec_ie[1] + 2; - len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX; + len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1; for (i = 0; i < len; i++) p += sprintf(p, "%02x", sec_ie[i]); p += sprintf(p, ")"); |