wlags49_h2: Fix overflow in wireless_set_essid()
authorMaurizio Lombardi <mlombard@redhat.com>
Wed, 5 Feb 2014 15:46:56 +0000 (16:46 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 7 Feb 2014 19:10:08 +0000 (11:10 -0800)
This patch prevents the wireless_set_essid() function from overwriting
the last byte of the NetworkName buffer which must be NULL.

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/wlags49_h2/wl_wext.c

index 4a1ddaf5e00f85bf3bcd6e4e41238449216464e4..187fc060de26bc732a434790c159b2274a83ebfc 100644 (file)
@@ -1061,7 +1061,7 @@ static int wireless_set_essid(struct net_device *dev, struct iw_request_info *in
                goto out;
        }
 
-       if (data->flags != 0 && data->length > HCF_MAX_NAME_LEN + 1) {
+       if (data->flags != 0 && data->length > HCF_MAX_NAME_LEN) {
                ret = -EINVAL;
                goto out;
        }