aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Woodhouse <dwmw2@infradead.org>2007-05-25 23:41:16 -0400
committerJohn W. Linville <linville@tuxdriver.com>2007-06-11 14:28:46 -0400
commit707985b3850f6ff168340e20b7f6b783782fb8ed (patch)
tree38e3d8501615370595cdbf002197959f71dcc8e6
parente5b3d472ad4eaa9013fd9f67f7a1b132f3ec910c (diff)
[PATCH] libertas: fix big-endian associate command.
Byte-swapping length fields and then passing them to memcpy() considered harmful. Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--drivers/net/wireless/libertas/join.c22
1 files changed, 11 insertions, 11 deletions
diff --git a/drivers/net/wireless/libertas/join.c b/drivers/net/wireless/libertas/join.c
index 781b563a2f4..b728f7fb9e3 100644
--- a/drivers/net/wireless/libertas/join.c
+++ b/drivers/net/wireless/libertas/join.c
@@ -362,25 +362,25 @@ int libertas_cmd_80211_associate(wlan_private * priv,
ssid = (struct mrvlietypes_ssidparamset *) pos;
ssid->header.type = cpu_to_le16(TLV_TYPE_SSID);
- ssid->header.len = cpu_to_le16(bss->ssid.ssidlength);
- memcpy(ssid->ssid, bss->ssid.ssid, ssid->header.len);
- pos += sizeof(ssid->header) + ssid->header.len;
- ssid->header.len = cpu_to_le16(ssid->header.len);
+ tmplen = bss->ssid.ssidlength;
+ ssid->header.len = cpu_to_le16(tmplen);
+ memcpy(ssid->ssid, bss->ssid.ssid, tmplen);
+ pos += sizeof(ssid->header) + tmplen;
phy = (struct mrvlietypes_phyparamset *) pos;
phy->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
- phy->header.len = cpu_to_le16(sizeof(phy->fh_ds.dsparamset));
+ tmplen = sizeof(phy->fh_ds.dsparamset);
+ phy->header.len = cpu_to_le16(tmplen);
memcpy(&phy->fh_ds.dsparamset,
&bss->phyparamset.dsparamset.currentchan,
- sizeof(phy->fh_ds.dsparamset));
- pos += sizeof(phy->header) + phy->header.len;
- phy->header.len = cpu_to_le16(phy->header.len);
+ tmplen);
+ pos += sizeof(phy->header) + tmplen;
ss = (struct mrvlietypes_ssparamset *) pos;
ss->header.type = cpu_to_le16(TLV_TYPE_CF);
- ss->header.len = cpu_to_le16(sizeof(ss->cf_ibss.cfparamset));
- pos += sizeof(ss->header) + ss->header.len;
- ss->header.len = cpu_to_le16(ss->header.len);
+ tmplen = sizeof(ss->cf_ibss.cfparamset);
+ ss->header.len = cpu_to_le16(tmplen);
+ pos += sizeof(ss->header) + tmplen;
rates = (struct mrvlietypes_ratesparamset *) pos;
rates->header.type = cpu_to_le16(TLV_TYPE_RATES);