From: Larry Finger <Larry.Finger@lwfinger.net>
Date: Tue, 27 Nov 2012 18:08:44 +0000 (-0600)
Subject: staging: r8712u: Fix possible buffer overrun
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=8b7a13c3f404cbd26b495fa9c34339cb9b7b8164;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

staging: r8712u: Fix possible buffer overrun

In routine r8712_report_sec_ie(), the code could set the length
of the buffer to 256; however, that value is one larger than the
corresponding memory allocation.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/rtl8712/mlme_linux.c b/drivers/staging/rtl8712/mlme_linux.c
index abf96c14df93..7279854c86aa 100644
--- a/drivers/staging/rtl8712/mlme_linux.c
+++ b/drivers/staging/rtl8712/mlme_linux.c
@@ -156,7 +156,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
 		p = buff;
 		p += sprintf(p, "ASSOCINFO(ReqIEs=");
 		len = sec_ie[1] + 2;
-		len =  (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
+		len =  (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1;
 		for (i = 0; i < len; i++)
 			p += sprintf(p, "%02x", sec_ie[i]);
 		p += sprintf(p, ")");