From: Dan Carpenter Date: Mon, 28 Dec 2009 17:01:34 +0000 (+0200) Subject: Staging: otus: off by one in usbdrvwext_siwessid() X-Git-Tag: MMI-PSA29.97-13-9~24618^2~1^2~238 X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=1c7e4a7c326c916918b5a29051db4f93973e775a;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git Staging: otus: off by one in usbdrvwext_siwessid() A 33 char ESSID is too long and it could cause a buffer overflow a couple lines below when we put a NULL terminator on the end. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/otus/ioctl.c b/drivers/staging/otus/ioctl.c index 6808e69fb354..86d93330acad 100644 --- a/drivers/staging/otus/ioctl.c +++ b/drivers/staging/otus/ioctl.c @@ -930,7 +930,7 @@ int usbdrvwext_siwessid(struct net_device *dev, return -EINVAL; if (essid->flags == 1) { - if (essid->length > (IW_ESSID_MAX_SIZE + 1)) + if (essid->length > IW_ESSID_MAX_SIZE) return -E2BIG; if (copy_from_user(&EssidBuf, essid->pointer, essid->length))