mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 14:44:12 +00:00
Code Issues Releases Wiki Activity

rtl871x: avoid running off end of buffer

Browse source 
If 32 bytes of non zero are passed in pdata->pointer then the mac_pton
function will run off the end of the buffer. Make sure we always have a
terminated string kernel side.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alan 2016-02-15 18:58:10 +00:00 committed by Greg Kroah-Hartman
parent d6e29ca1f6
commit 0c68423556
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/staging/rtl8712/rtl871x_ioctl_linux.c
View file

@ -1961,7 +1961,7 @@ static int r871x_get_ap_info(struct net_device *dev,
struct list_head *plist, *phead;
unsigned char *pbuf;
u8 bssid[ETH_ALEN];
char data[32];
char data[33];
if (padapter->bDriverStopped || (pdata == NULL))
return -EINVAL;
@ -1976,6 +1976,7 @@ static int r871x_get_ap_info(struct net_device *dev,
if (pdata->length >= 32) {
if (copy_from_user(data, pdata->pointer, 32))
return -EINVAL;
data[32] = 0;
} else {
return -EINVAL;
}