lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

airo: fix airo_get_encode{,ext} buffer overflow like I mean it...

Browse Source 
"airo: airo_get_encode{,ext} potential buffer overflow" was actually a
no-op, due to an unrecognized type overflow in an assignment.  Oddly,
gcc only seems to tell me about it when using -Wextra...grrr...

Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
John W. Linville
2009-05-20 10:51:41 -04:00
parent 875690c378
commit 267d493b32
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/net/wireless/airo.c
View File

@@ -6467,6 +6467,7 @@ static int airo_get_encode(struct net_device *dev,
{ {
struct airo_info *local = dev->ml_priv; struct airo_info *local = dev->ml_priv;
int index = (dwrq->flags & IW_ENCODE_INDEX) - 1; int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
int wep_key_len;
u8 buf[16]; u8 buf[16];
if (!local->wep_capable) if (!local->wep_capable)
@@ -6500,11 +6501,13 @@ static int airo_get_encode(struct net_device *dev,
dwrq->flags |= index + 1; dwrq->flags |= index + 1;
/* Copy the key to the user buffer */ /* Copy the key to the user buffer */
dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf)); wep_key_len = get_wep_key(local, index, &buf[0], sizeof(buf));
if (dwrq->length != -1) if (wep_key_len < 0) {
memcpy(extra, buf, dwrq->length);
else
dwrq->length = 0; dwrq->length = 0;
} else {
dwrq->length = wep_key_len;
memcpy(extra, buf, dwrq->length);
}
return 0; return 0;
} }
@@ -6617,7 +6620,7 @@ static int airo_get_encodeext(struct net_device *dev,
struct airo_info *local = dev->ml_priv; struct airo_info *local = dev->ml_priv;
struct iw_point *encoding = &wrqu->encoding; struct iw_point *encoding = &wrqu->encoding;
struct iw_encode_ext *ext = (struct iw_encode_ext *)extra; struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
int idx, max_key_len; int idx, max_key_len, wep_key_len;
u8 buf[16]; u8 buf[16];
if (!local->wep_capable) if (!local->wep_capable)
@@ -6661,11 +6664,13 @@ static int airo_get_encodeext(struct net_device *dev,
memset(extra, 0, 16); memset(extra, 0, 16);
/* Copy the key to the user buffer */ /* Copy the key to the user buffer */
ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf)); wep_key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
if (ext->key_len != -1) if (wep_key_len < 0) {
memcpy(extra, buf, ext->key_len);
else
ext->key_len = 0; ext->key_len = 0;
} else {
ext->key_len = wep_key_len;
memcpy(extra, buf, ext->key_len);
}
return 0; return 0;
} }