Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 708d019f authored by Chen Gang's avatar Chen Gang Committed by John W. Linville
Browse files

drivers/net/wireless: need consider the not '\0' terminated string. 



  in ray_cs.c:
    the a_current_ess_id is "Null terminated unless ESSID_SIZE long"
    so we need buffer it with '\0' firstly, before using strlen or %s.

  additional information:
    in drivers/net/wireless/rayctl.h:
      "NULL terminated unless 32 long" is a comment at line 616, 664
      ESSID_SIZE is 32, at line 190
    in include/uapi/linux/wireless.h:
      IW_ESSID_MAX_SIZE is also 32
    in drivers/net/wireless/ray_cs.c:
      use strncpy for it, without '\0' terminated, at line 639
      use memcpy for it, assume not '\0' terminated in line 1092..1097
      buffer it with '\0' firstly, before using %s, in line 2576, 2598..2600

Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 6aaacd86

drivers/net/wireless/ray_cs.c

+14 −5
Original line number Diff line number Diff line
@@ -1107,12 +1107,15 @@ static int ray_get_essid(struct net_device *dev, struct iw_request_info *info, 
			 union iwreq_data *wrqu, char *extra)

{

	ray_dev_t *local = netdev_priv(dev);

	UCHAR tmp[IW_ESSID_MAX_SIZE + 1];



	/* Get the essid that was set */

	memcpy(extra, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);

	memcpy(tmp, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);

	tmp[IW_ESSID_MAX_SIZE] = '\0';



	/* Push it out ! */

	wrqu->essid.length = strlen(extra);

	wrqu->essid.length = strlen(tmp);

	wrqu->essid.flags = 1;	/* active */



	return 0;
@@ -1842,6 +1845,8 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id) 
	UCHAR tmp;

	UCHAR cmd;

	UCHAR status;

	UCHAR memtmp[ESSID_SIZE + 1];





	if (dev == NULL)	/* Note that we want interrupts with dev->start == 0 */

		return IRQ_NONE;
@@ -1901,17 +1906,21 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id) 
			break;

		case CCS_START_NETWORK:

		case CCS_JOIN_NETWORK:

			memcpy(memtmp, local->sparm.b4.a_current_ess_id,

								ESSID_SIZE);

			memtmp[ESSID_SIZE] = '\0';



			if (status == CCS_COMMAND_COMPLETE) {

				if (readb

				    (&pccs->var.start_network.net_initiated) ==

				    1) {

					dev_dbg(&link->dev,

					      "ray_cs interrupt network \"%s\" started\n",

					      local->sparm.b4.a_current_ess_id);

					      memtmp);

				} else {

					dev_dbg(&link->dev,

					      "ray_cs interrupt network \"%s\" joined\n",

					      local->sparm.b4.a_current_ess_id);

					      memtmp);

				}

				memcpy_fromio(&local->bss_id,

					      pccs->var.start_network.bssid,
@@ -1939,12 +1948,12 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id) 
				if (status == CCS_START_NETWORK) {

					dev_dbg(&link->dev,

					      "ray_cs interrupt network \"%s\" start failed\n",

					      local->sparm.b4.a_current_ess_id);

					      memtmp);

					local->timer.function = start_net;

				} else {

					dev_dbg(&link->dev,

					      "ray_cs interrupt network \"%s\" join failed\n",

					      local->sparm.b4.a_current_ess_id);

					      memtmp);

					local->timer.function = join_net;

				}

				add_timer(&local->timer);