Commit 40f9cd29 authored Nov 21, 2011 by Dan Carpenter Committed by John W. Linville Nov 21, 2011

prism54: potential memory corruption in prism54_get_essid()



"dwrq->length" is the capped version of "essid->length".

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent de3584bd

drivers/net/wireless/prism54/isl_ioctl.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -778,7 +778,7 @@ prism54_get_essid(struct net_device ndev, struct iw_request_info info,
		dwrq->flags = 0;
		dwrq->length = 0;
		}
		essid->octets[essid->length] = '\0';
		essid->octets[dwrq->length] = '\0';
		memcpy(extra, essid->octets, dwrq->length);
		kfree(essid);