From: Dan Carpenter Date: Mon, 21 Nov 2011 14:47:13 +0000 (+0300) Subject: prism54: potential memory corruption in prism54_get_essid() X-Git-Tag: upstream/snapshot3+hdmi~8468^2^2~32 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=40f9cd299a0e5e8dcdde9b5eb9bfda1cb9109f61;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git prism54: potential memory corruption in prism54_get_essid() "dwrq->length" is the capped version of "essid->length". Signed-off-by: Dan Carpenter Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c index d97a2caf..bc2ba80 100644 --- a/drivers/net/wireless/prism54/isl_ioctl.c +++ b/drivers/net/wireless/prism54/isl_ioctl.c @@ -778,7 +778,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info, dwrq->flags = 0; dwrq->length = 0; } - essid->octets[essid->length] = '\0'; + essid->octets[dwrq->length] = '\0'; memcpy(extra, essid->octets, dwrq->length); kfree(essid);