lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mac80211: fix a buffer overrun in station debug code

Browse Source 
net/mac80211/debugfs_sta.c
The trailing zero was written to state[4], it's out of bounds.

Signed-off-by: Jianjun Kong <jianjun@zeuux.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jianjun Kong
2008-11-10 21:37:39 -08:00
committed by David S. Miller
parent b7b45f47d6
commit 013cd39753
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
net/mac80211/debugfs_sta.c
View File

@@ -199,7 +199,7 @@ static ssize_t sta_agg_status_write(struct file *file,
/* toggle Rx aggregation command */ /* toggle Rx aggregation command */
tid_num = tid_num - 100; tid_num = tid_num - 100;
if (tid_static_rx[tid_num] == 1) { if (tid_static_rx[tid_num] == 1) {
strcpy(state, "off "); strcpy(state, "off");
ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0, ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
WLAN_REASON_QSTA_REQUIRE_SETUP); WLAN_REASON_QSTA_REQUIRE_SETUP);
sta->ampdu_mlme.tid_state_rx[tid_num] |= sta->ampdu_mlme.tid_state_rx[tid_num] |=