diff options
| author | Larry Finger <Larry.Finger@lwfinger.net> | 2012-11-27 12:08:44 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-11-28 08:49:21 -0800 |
| commit | 8b7a13c3f404cbd26b495fa9c34339cb9b7b8164 (patch) | |
| tree | 52ad2d0b5f1342665b867e9be00ea3f4ed175cde | |
| parent | 0df1a84e0ec875d1bc12ac6aca325cb3543a7ad6 (diff) | |
staging: r8712u: Fix possible buffer overrun
In routine r8712_report_sec_ie(), the code could set the length
of the buffer to 256; however, that value is one larger than the
corresponding memory allocation.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/rtl8712/mlme_linux.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/rtl8712/mlme_linux.c b/drivers/staging/rtl8712/mlme_linux.c index abf96c14df93..7279854c86aa 100644 --- a/drivers/staging/rtl8712/mlme_linux.c +++ b/drivers/staging/rtl8712/mlme_linux.c @@ -156,7 +156,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie) p = buff; p += sprintf(p, "ASSOCINFO(ReqIEs="); len = sec_ie[1] + 2; - len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX; + len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1; for (i = 0; i < len; i++) p += sprintf(p, "%02x", sec_ie[i]); p += sprintf(p, ")"); |