lkml.org 
[lkml]   [2009]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] Libertas: fix buffer overflow in lbs_get_essid()
    On Wed, Dec 16, 2009 at 08:57:47AM -0800, Dan Williams wrote:
    > On Wed, 2009-12-16 at 05:12 +0100, Daniel Mack wrote:
    > > The libertas driver copies the SSID buffer back to the wireless core and
    > > appends a trailing NULL character for termination. This is
    > >
    > > a) unnecessary because the buffer is allocated with kzalloc and is hence
    > > already NULLed when this function is called, and
    > >
    > > b) for priv->curbssparams.ssid_len == 32, it writes back one byte too
    > > much which causes memory corruptions.
    > >
    > > Fix this by removing the extra write.
    >
    > Acked-by: Dan Williams <dcbw@redhat.com>

    Thanks, everyone. Who will care to pick an queue this one?

    Daniel


    > > Signed-off-by: Daniel Mack <daniel@caiaq.de>
    > > Cc: Dan Williams <dcbw@redhat.com>
    > > Cc: Holger Schurig <holgerschurig@gmail.com>
    > > Cc: John W. Linville <linville@tuxdriver.com>
    > > Cc: Stephen Hemminger <shemminger@vyatta.com>
    > > Cc: Maithili Hinge <maithili@marvell.com>
    > > Cc: Kiran Divekar <dkiran@marvell.com>
    > > Cc: Michael Hirsch <m.hirsch@raumfeld.com>
    > > Cc: netdev@vger.kernel.org
    > > Cc: libertas-dev@lists.infradead.org
    > > Cc: linux-wireless@lists.infradead.org
    > > Cc: stable@kernel.org
    > > ---
    > > drivers/net/wireless/libertas/wext.c | 2 --
    > > 1 files changed, 0 insertions(+), 2 deletions(-)
    > >
    > > diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
    > > index be837a0..01c738b 100644
    > > --- a/drivers/net/wireless/libertas/wext.c
    > > +++ b/drivers/net/wireless/libertas/wext.c
    > > @@ -1953,10 +1953,8 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
    > > if (priv->connect_status == LBS_CONNECTED) {
    > > memcpy(extra, priv->curbssparams.ssid,
    > > priv->curbssparams.ssid_len);
    > > - extra[priv->curbssparams.ssid_len] = '\0';
    > > } else {
    > > memset(extra, 0, 32);
    > > - extra[priv->curbssparams.ssid_len] = '\0';
    > > }
    > > /*
    > > * If none, we may want to get the one that was set
    >


    \
     
     \ /
      Last update: 2009-12-17 00:17    [W:0.047 / U:0.112 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site