diff options
| author | David Woodhouse <dwmw2@infradead.org> | 2007-05-25 23:41:16 -0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2007-06-11 14:28:46 -0400 |
| commit | 707985b3850f6ff168340e20b7f6b783782fb8ed (patch) | |
| tree | 38e3d8501615370595cdbf002197959f71dcc8e6 | |
| parent | e5b3d472ad4eaa9013fd9f67f7a1b132f3ec910c (diff) | |
[PATCH] libertas: fix big-endian associate command.
Byte-swapping length fields and then passing them to memcpy() considered
harmful.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/libertas/join.c | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/drivers/net/wireless/libertas/join.c b/drivers/net/wireless/libertas/join.c index 781b563a2f4..b728f7fb9e3 100644 --- a/drivers/net/wireless/libertas/join.c +++ b/drivers/net/wireless/libertas/join.c @@ -362,25 +362,25 @@ int libertas_cmd_80211_associate(wlan_private * priv, ssid = (struct mrvlietypes_ssidparamset *) pos; ssid->header.type = cpu_to_le16(TLV_TYPE_SSID); - ssid->header.len = cpu_to_le16(bss->ssid.ssidlength); - memcpy(ssid->ssid, bss->ssid.ssid, ssid->header.len); - pos += sizeof(ssid->header) + ssid->header.len; - ssid->header.len = cpu_to_le16(ssid->header.len); + tmplen = bss->ssid.ssidlength; + ssid->header.len = cpu_to_le16(tmplen); + memcpy(ssid->ssid, bss->ssid.ssid, tmplen); + pos += sizeof(ssid->header) + tmplen; phy = (struct mrvlietypes_phyparamset *) pos; phy->header.type = cpu_to_le16(TLV_TYPE_PHY_DS); - phy->header.len = cpu_to_le16(sizeof(phy->fh_ds.dsparamset)); + tmplen = sizeof(phy->fh_ds.dsparamset); + phy->header.len = cpu_to_le16(tmplen); memcpy(&phy->fh_ds.dsparamset, &bss->phyparamset.dsparamset.currentchan, - sizeof(phy->fh_ds.dsparamset)); - pos += sizeof(phy->header) + phy->header.len; - phy->header.len = cpu_to_le16(phy->header.len); + tmplen); + pos += sizeof(phy->header) + tmplen; ss = (struct mrvlietypes_ssparamset *) pos; ss->header.type = cpu_to_le16(TLV_TYPE_CF); - ss->header.len = cpu_to_le16(sizeof(ss->cf_ibss.cfparamset)); - pos += sizeof(ss->header) + ss->header.len; - ss->header.len = cpu_to_le16(ss->header.len); + tmplen = sizeof(ss->cf_ibss.cfparamset); + ss->header.len = cpu_to_le16(tmplen); + pos += sizeof(ss->header) + tmplen; rates = (struct mrvlietypes_ratesparamset *) pos; rates->header.type = cpu_to_le16(TLV_TYPE_RATES); |