diff options
author | Jean Tourrilhes <jt@hpl.hp.com> | 2006-10-10 17:45:46 -0400 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2006-10-16 20:09:48 -0400 |
commit | 53077944f119808df3d1c6be07241f17a87e7c28 (patch) | |
tree | 3427e3f0ba877eaeaed102ebcd32fb90afa5e865 /drivers/net/wireless/atmel.c | |
parent | 683f8c9e00d2aa911382186ca891bd221efaea74 (diff) |
[PATCH] wireless: More WE-21 potential overflows...
After the Orinoco issue, I did an audit of other drivers for the same
issue. Three drivers were NULL terminating the ESSID, which could cause an
overflow in WE-21 when the ESSID has maximum size.
Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/atmel.c')
-rw-r--r-- | drivers/net/wireless/atmel.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c index 31eed85de60f..0c07b8b7250d 100644 --- a/drivers/net/wireless/atmel.c +++ b/drivers/net/wireless/atmel.c | |||
@@ -1678,11 +1678,9 @@ static int atmel_get_essid(struct net_device *dev, | |||
1678 | /* Get the current SSID */ | 1678 | /* Get the current SSID */ |
1679 | if (priv->new_SSID_size != 0) { | 1679 | if (priv->new_SSID_size != 0) { |
1680 | memcpy(extra, priv->new_SSID, priv->new_SSID_size); | 1680 | memcpy(extra, priv->new_SSID, priv->new_SSID_size); |
1681 | extra[priv->new_SSID_size] = '\0'; | ||
1682 | dwrq->length = priv->new_SSID_size; | 1681 | dwrq->length = priv->new_SSID_size; |
1683 | } else { | 1682 | } else { |
1684 | memcpy(extra, priv->SSID, priv->SSID_size); | 1683 | memcpy(extra, priv->SSID, priv->SSID_size); |
1685 | extra[priv->SSID_size] = '\0'; | ||
1686 | dwrq->length = priv->SSID_size; | 1684 | dwrq->length = priv->SSID_size; |
1687 | } | 1685 | } |
1688 | 1686 | ||