Commit 0c684235 authored by Alan's avatar Alan Committed by Greg Kroah-Hartman

rtl871x: avoid running off end of buffer

If 32 bytes of non zero are passed in pdata->pointer then the mac_pton
function will run off the end of the buffer. Make sure we always have a
terminated string kernel side.
Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d6e29ca1
......@@ -1961,7 +1961,7 @@ static int r871x_get_ap_info(struct net_device *dev,
struct list_head *plist, *phead;
unsigned char *pbuf;
u8 bssid[ETH_ALEN];
char data[32];
char data[33];
if (padapter->bDriverStopped || (pdata == NULL))
return -EINVAL;
......@@ -1976,6 +1976,7 @@ static int r871x_get_ap_info(struct net_device *dev,
if (pdata->length >= 32) {
if (copy_from_user(data, pdata->pointer, 32))
return -EINVAL;
data[32] = 0;
} else {
return -EINVAL;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment