lkml.org 
[lkml]   [2009]   [Dec]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] Libertas: fix buffer overflow in lbs_get_essid()
    Date
    The libertas driver copies the SSID buffer back to the wireless core and
    appends a trailing NULL character for termination. This is

    a) unnecessary because the buffer is allocated with kzalloc and is hence
    already NULLed when this function is called, and

    b) for priv->curbssparams.ssid_len == 32, it writes back one byte too
    much which causes memory corruptions.

    Fix this by removing the extra write.

    Signed-off-by: Daniel Mack <daniel@caiaq.de>
    Cc: Dan Williams <dcbw@redhat.com>
    Cc: Holger Schurig <holgerschurig@gmail.com>
    Cc: John W. Linville <linville@tuxdriver.com>
    Cc: Stephen Hemminger <shemminger@vyatta.com>
    Cc: Maithili Hinge <maithili@marvell.com>
    Cc: Kiran Divekar <dkiran@marvell.com>
    Cc: Michael Hirsch <m.hirsch@raumfeld.com>
    Cc: netdev@vger.kernel.org
    Cc: libertas-dev@lists.infradead.org
    Cc: linux-wireless@lists.infradead.org
    Cc: stable@kernel.org
    ---
    drivers/net/wireless/libertas/wext.c | 2 --
    1 files changed, 0 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
    index be837a0..01c738b 100644
    --- a/drivers/net/wireless/libertas/wext.c
    +++ b/drivers/net/wireless/libertas/wext.c
    @@ -1953,10 +1953,8 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
    if (priv->connect_status == LBS_CONNECTED) {
    memcpy(extra, priv->curbssparams.ssid,
    priv->curbssparams.ssid_len);
    - extra[priv->curbssparams.ssid_len] = '\0';
    } else {
    memset(extra, 0, 32);
    - extra[priv->curbssparams.ssid_len] = '\0';
    }
    /*
    * If none, we may want to get the one that was set
    --
    1.6.3.3


    \
     
     \ /
      Last update: 2009-12-16 05:15    [W:5.615 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site