iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

staging: r8712u: Fix possible buffer overrun

Browse Source 
In routine r8712_report_sec_ie(), the code could set the length
of the buffer to 256; however, that value is one larger than the
corresponding memory allocation.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Larry Finger 2012-11-27 12:08:44 -06:00 committed by Greg Kroah-Hartman
parent 0df1a84e0e
commit 8b7a13c3f4
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/staging/rtl8712/mlme_linux.c
View File

@ -156,7 +156,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
p = buff; p = buff;
p += sprintf(p, "ASSOCINFO(ReqIEs="); p += sprintf(p, "ASSOCINFO(ReqIEs=");
len = sec_ie[1] + 2; len = sec_ie[1] + 2;
len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX; len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1;
for (i = 0; i < len; i++) for (i = 0; i < len; i++)
p += sprintf(p, "%02x", sec_ie[i]); p += sprintf(p, "%02x", sec_ie[i]);
p += sprintf(p, ")"); p += sprintf(p, ")");