Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53077944 authored by Jean Tourrilhes's avatar Jean Tourrilhes Committed by John W. Linville
Browse files

[PATCH] wireless: More WE-21 potential overflows... 



After the Orinoco issue, I did an audit of other drivers for the same
issue.  Three drivers were NULL terminating the ESSID, which could cause an
overflow in WE-21 when the ESSID has maximum size.

Signed-off-by: default avatarJean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 683f8c9e

drivers/net/wireless/airo.c

+0 −1
Original line number Diff line number Diff line
@@ -5970,7 +5970,6 @@ static int airo_get_essid(struct net_device *dev, 


	/* Get the current SSID */

	memcpy(extra, status_rid.SSID, status_rid.SSIDlen);

	extra[status_rid.SSIDlen] = '\0';

	/* If none, we may want to get the one that was set */



	/* Push it out ! */

drivers/net/wireless/atmel.c

+0 −2
Original line number Diff line number Diff line
@@ -1678,11 +1678,9 @@ static int atmel_get_essid(struct net_device *dev, 
	/* Get the current SSID */

	if (priv->new_SSID_size != 0) {

		memcpy(extra, priv->new_SSID, priv->new_SSID_size);

		extra[priv->new_SSID_size] = '\0';

		dwrq->length = priv->new_SSID_size;

	} else {

		memcpy(extra, priv->SSID, priv->SSID_size);

		extra[priv->SSID_size] = '\0';

		dwrq->length = priv->SSID_size;

	}

drivers/net/wireless/ray_cs.c

+0 −1
Original line number Diff line number Diff line
@@ -1198,7 +1198,6 @@ static int ray_get_essid(struct net_device *dev, 


	/* Get the essid that was set */

	memcpy(extra, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);

	extra[IW_ESSID_MAX_SIZE] = '\0';



	/* Push it out ! */

	dwrq->length = strlen(extra);