Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit d89dba7a authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville
Browse files

libertas: fix write past end of array in mesh_id_get()



defs.meshie.val.mesh_id is 32 chars long.  It's not supposed to be NUL
terminated.  This code puts a terminator on the end to make it easier to
print to sysfs.  The problem is that if the mesh_id fills the entire
buffer the original code puts the terminator one spot past the end.

The way the original code was written, there was a check to make sure
that maxlen was less than PAGE_SIZE.  Since we know that maxlen is at
most 34 chars, I just removed the check.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Acked-by: default avatarDan Williams <dcbw@redhat.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 23952ec9
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment