Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 707985b3 authored by David Woodhouse's avatar David Woodhouse Committed by John W. Linville
Browse files

[PATCH] libertas: fix big-endian associate command. 



Byte-swapping length fields and then passing them to memcpy() considered
harmful.

Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent e5b3d472

drivers/net/wireless/libertas/join.c

+11 −11
Original line number Original line Diff line number Diff line
@@ -362,25 +362,25 @@ int libertas_cmd_80211_associate(wlan_private * priv, 




	ssid = (struct mrvlietypes_ssidparamset *) pos;

	ssid = (struct mrvlietypes_ssidparamset *) pos;

	ssid->header.type = cpu_to_le16(TLV_TYPE_SSID);

	ssid->header.type = cpu_to_le16(TLV_TYPE_SSID);

	ssid->header.len = cpu_to_le16(bss->ssid.ssidlength);

	tmplen = bss->ssid.ssidlength;

	memcpy(ssid->ssid, bss->ssid.ssid, ssid->header.len);

	ssid->header.len = cpu_to_le16(tmplen);

	pos += sizeof(ssid->header) + ssid->header.len;

	memcpy(ssid->ssid, bss->ssid.ssid, tmplen);

	ssid->header.len = cpu_to_le16(ssid->header.len);

	pos += sizeof(ssid->header) + tmplen;





	phy = (struct mrvlietypes_phyparamset *) pos;

	phy = (struct mrvlietypes_phyparamset *) pos;

	phy->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);

	phy->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);

	phy->header.len = cpu_to_le16(sizeof(phy->fh_ds.dsparamset));

	tmplen = sizeof(phy->fh_ds.dsparamset);

	phy->header.len = cpu_to_le16(tmplen);

	memcpy(&phy->fh_ds.dsparamset,

	memcpy(&phy->fh_ds.dsparamset,

	       &bss->phyparamset.dsparamset.currentchan,

	       &bss->phyparamset.dsparamset.currentchan,

	       sizeof(phy->fh_ds.dsparamset));

	       tmplen);

	pos += sizeof(phy->header) + phy->header.len;

	pos += sizeof(phy->header) + tmplen;

	phy->header.len = cpu_to_le16(phy->header.len);





	ss = (struct mrvlietypes_ssparamset *) pos;

	ss = (struct mrvlietypes_ssparamset *) pos;

	ss->header.type = cpu_to_le16(TLV_TYPE_CF);

	ss->header.type = cpu_to_le16(TLV_TYPE_CF);

	ss->header.len = cpu_to_le16(sizeof(ss->cf_ibss.cfparamset));

	tmplen = sizeof(ss->cf_ibss.cfparamset);

	pos += sizeof(ss->header) + ss->header.len;

	ss->header.len = cpu_to_le16(tmplen);

	ss->header.len = cpu_to_le16(ss->header.len);

	pos += sizeof(ss->header) + tmplen;





	rates = (struct mrvlietypes_ratesparamset *) pos;

	rates = (struct mrvlietypes_ratesparamset *) pos;

	rates->header.type = cpu_to_le16(TLV_TYPE_RATES);

	rates->header.type = cpu_to_le16(TLV_TYPE_RATES);