[lkml]   [2006]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: 2.6.18-mm2 - oops in cache_alloc_refill()
    >>>>> "Jean" == Jean Tourrilhes <> writes:

    Jean> @@ -2500,9 +2501,9 @@ static int orinoco_hw_get_essid(struct o
    Jean> len = le16_to_cpu(essidbuf.len);
    Jean> BUG_ON(len > IW_ESSID_MAX_SIZE);
    Jean> - memset(buf, 0, IW_ESSID_MAX_SIZE+1);
    Jean> + memset(buf, 0, IW_ESSID_MAX_SIZE);
    Jean> memcpy(buf, p, len);
    Jean> - buf[len] = '\0';
    Jean> + err = len;


    something bugs me here:

    - either buf is supposed to be a nul-terminated string, in which
    case if p is IW_ESSID_MAX_SIZE long there may be a bug (no '\0' at
    the end of buf)

    - either buf is not-supposed to be nul-terminated and the length
    value will always be used, in which case the memset() looks

    I suggest that you revert the memset() to IW_ESSID_MAX_SIZE+1 so that
    the last byte is cleared as well. Or am I missing something?

    Samuel Tardieu -- --

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2006-10-03 18:01    [W:0.024 / U:25.840 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site