prism54: potential memory corruption in prism54_get_essid()
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 21 Nov 2011 14:47:13 +0000 (17:47 +0300)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 21 Nov 2011 19:45:21 +0000 (14:45 -0500)
"dwrq->length" is the capped version of "essid->length".

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/prism54/isl_ioctl.c

index d97a2caf582b3997f2378434117758a928cefbd3..bc2ba80c47bb9ff0105d8ed2c119ab3b3589364e 100644 (file)
@@ -778,7 +778,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
                dwrq->flags = 0;
                dwrq->length = 0;
        }
-       essid->octets[essid->length] = '\0';
+       essid->octets[dwrq->length] = '\0';
        memcpy(extra, essid->octets, dwrq->length);
        kfree(essid);