Commit 40f9cd29 authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville

prism54: potential memory corruption in prism54_get_essid()

"dwrq->length" is the capped version of "essid->length".
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent de3584bd
...@@ -778,7 +778,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info, ...@@ -778,7 +778,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
dwrq->flags = 0; dwrq->flags = 0;
dwrq->length = 0; dwrq->length = 0;
} }
essid->octets[essid->length] = '\0'; essid->octets[dwrq->length] = '\0';
memcpy(extra, essid->octets, dwrq->length); memcpy(extra, essid->octets, dwrq->length);
kfree(essid); kfree(essid);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment