diff options
| author | Dan Aloni <[email protected]> | 2009-06-20 16:32:22 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2009-07-12 13:21:45 -0700 |
| commit | 02c8baecf5d8850dba40b47cdf003ed2e04e66dd (patch) | |
| tree | 78cb75f4d14bb25c72893e66da5a6c1d94a13924 /net/lapb/lapb_subr.c | |
| parent | 77b9288197b6034c44abe2619aff62cba056a713 (diff) | |
Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME
I repeatedly get __stack_chk_fail panic()s with this driver before
applying the attached fix.
ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.
length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17
This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.
It can be applied to 2.6.30-stable as well.
Signed-off-by: Dan Aloni <[email protected]>
Cc: Bartlomiej Zolnierkiewicz <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'net/lapb/lapb_subr.c')
0 files changed, 0 insertions, 0 deletions