Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0c684235 authored by Alan's avatar Alan Committed by Greg Kroah-Hartman
Browse files

rtl871x: avoid running off end of buffer 



If 32 bytes of non zero are passed in pdata->pointer then the mac_pton
function will run off the end of the buffer. Make sure we always have a
terminated string kernel side.

Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d6e29ca1

drivers/staging/rtl8712/rtl871x_ioctl_linux.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -1961,7 +1961,7 @@ static int r871x_get_ap_info(struct net_device *dev, 
	struct list_head *plist, *phead;

	struct list_head *plist, *phead;

	unsigned char *pbuf;

	unsigned char *pbuf;

	u8 bssid[ETH_ALEN];

	u8 bssid[ETH_ALEN];

	char data[32];

	char data[33];





	if (padapter->bDriverStopped || (pdata == NULL))

	if (padapter->bDriverStopped || (pdata == NULL))

		return -EINVAL;

		return -EINVAL;
@@ -1976,6 +1976,7 @@ static int r871x_get_ap_info(struct net_device *dev, 
	if (pdata->length >= 32) {

	if (pdata->length >= 32) {

		if (copy_from_user(data, pdata->pointer, 32))

		if (copy_from_user(data, pdata->pointer, 32))

			return -EINVAL;

			return -EINVAL;

                data[32] = 0;

	} else {

	} else {

		 return -EINVAL;

		 return -EINVAL;

	}

	}