lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[PATCH] orinoco: fix WE-21 buffer overflow

Browse Source 
This patch fixes the Orinoco driver overflow issue with
WE-21.

Cc: Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
Cc: Pavel Roskin <proski@gnu.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Jean Tourrilhes
2006-10-10 14:45:44 -07:00
committed by John W. Linville
parent 431aca5a18
commit 7e4e8d99c2
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/net/wireless/orinoco.c
View File

@@ -2457,6 +2457,7 @@ void free_orinocodev(struct net_device *dev)
/* Wireless extensions */ /* Wireless extensions */
/********************************************************************/ /********************************************************************/
/* Return : < 0 -> error code ; >= 0 -> length */
static int orinoco_hw_get_essid(struct orinoco_private *priv, int *active, static int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
char buf[IW_ESSID_MAX_SIZE+1]) char buf[IW_ESSID_MAX_SIZE+1])
{ {
@@ -2501,9 +2502,9 @@ static int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
len = le16_to_cpu(essidbuf.len); len = le16_to_cpu(essidbuf.len);
BUG_ON(len > IW_ESSID_MAX_SIZE); BUG_ON(len > IW_ESSID_MAX_SIZE);
memset(buf, 0, IW_ESSID_MAX_SIZE+1); memset(buf, 0, IW_ESSID_MAX_SIZE);
memcpy(buf, p, len); memcpy(buf, p, len);
buf[len] = '\0'; err = len;
fail_unlock: fail_unlock:
orinoco_unlock(priv, &flags); orinoco_unlock(priv, &flags);
@@ -3027,17 +3028,18 @@ static int orinoco_ioctl_getessid(struct net_device *dev,
if (netif_running(dev)) { if (netif_running(dev)) {
err = orinoco_hw_get_essid(priv, &active, essidbuf); err = orinoco_hw_get_essid(priv, &active, essidbuf);
if (err) if (err < 0)
return err; return err;
erq->length = err;
} else { } else {
if (orinoco_lock(priv, &flags) != 0) if (orinoco_lock(priv, &flags) != 0)
return -EBUSY; return -EBUSY;
memcpy(essidbuf, priv->desired_essid, IW_ESSID_MAX_SIZE + 1); memcpy(essidbuf, priv->desired_essid, IW_ESSID_MAX_SIZE);
erq->length = strlen(priv->desired_essid);
orinoco_unlock(priv, &flags); orinoco_unlock(priv, &flags);
} }
erq->flags = 1; erq->flags = 1;
erq->length = strlen(essidbuf);
return 0; return 0;
} }
@@ -3075,10 +3077,10 @@ static int orinoco_ioctl_getnick(struct net_device *dev,
if (orinoco_lock(priv, &flags) != 0) if (orinoco_lock(priv, &flags) != 0)
return -EBUSY; return -EBUSY;
memcpy(nickbuf, priv->nick, IW_ESSID_MAX_SIZE+1); memcpy(nickbuf, priv->nick, IW_ESSID_MAX_SIZE);
orinoco_unlock(priv, &flags); orinoco_unlock(priv, &flags);
nrq->length = strlen(nickbuf); nrq->length = strlen(priv->nick);
return 0; return 0;
} }