diff options
| author | Dan Carpenter <error27@gmail.com> | 2009-12-28 19:01:34 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-03-03 16:42:39 -0800 |
| commit | 1c7e4a7c326c916918b5a29051db4f93973e775a (patch) | |
| tree | c0da24d3c385086ba829e75235d0154441af0c76 | |
| parent | ed30013207ef3e36da4f39db1298ae53f799e29c (diff) | |
Staging: otus: off by one in usbdrvwext_siwessid()
A 33 char ESSID is too long and it could cause a buffer overflow
a couple lines below when we put a NULL terminator on the end.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/staging/otus/ioctl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/otus/ioctl.c b/drivers/staging/otus/ioctl.c index 6808e69fb35..86d93330aca 100644 --- a/drivers/staging/otus/ioctl.c +++ b/drivers/staging/otus/ioctl.c @@ -930,7 +930,7 @@ int usbdrvwext_siwessid(struct net_device *dev, return -EINVAL; if (essid->flags == 1) { - if (essid->length > (IW_ESSID_MAX_SIZE + 1)) + if (essid->length > IW_ESSID_MAX_SIZE) return -E2BIG; if (copy_from_user(&EssidBuf, essid->pointer, essid->length)) |