mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
staging: r8712u: Fix possible buffer overrun
In routine r8712_report_sec_ie(), the code could set the length of the buffer to 256; however, that value is one larger than the corresponding memory allocation. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
0df1a84e0e
commit
8b7a13c3f4
1 changed files with 1 additions and 1 deletions
|
@ -156,7 +156,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
|
|||
p = buff;
|
||||
p += sprintf(p, "ASSOCINFO(ReqIEs=");
|
||||
len = sec_ie[1] + 2;
|
||||
len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
|
||||
len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1;
|
||||
for (i = 0; i < len; i++)
|
||||
p += sprintf(p, "%02x", sec_ie[i]);
|
||||
p += sprintf(p, ")");
|
||||
|
|
Loading…
Reference in a new issue