From 91fca6da389b897483b4c1edea29885172989fda Mon Sep 17 00:00:00 2001 From: Dan Aloni Date: Wed, 24 Jun 2009 22:34:39 +0300 Subject: Staging: prevent rtl8192su from crashing dev_ioctl in SIOCGIWNAME (adapted from the rtl8187se patch) ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and on certain conditions, the concatenated string will be larger than IFNAMSIZ including the terminating zero. length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17 This fix uses strl{cpy,cat} in addition to the reduction of the total possible length of the output string by a char. It can be applied to 2.6.30-stable as well. Signed-off-by: Dan Aloni Cc: Bartlomiej Zolnierkiewicz Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c index 1f50c46dcb90..191dc3fbbe32 100644 --- a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c +++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c @@ -548,21 +548,21 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee, struct iw_request_info *info, union iwreq_data *wrqu, char *extra) { - strcpy(wrqu->name, "802.11"); + strlcpy(wrqu->name, "802.11", IFNAMSIZ); if(ieee->modulation & IEEE80211_CCK_MODULATION){ - strcat(wrqu->name, "b"); + strlcat(wrqu->name, "b", IFNAMSIZ); if(ieee->modulation & IEEE80211_OFDM_MODULATION) - strcat(wrqu->name, "/g"); + strlcat(wrqu->name, "/g", IFNAMSIZ); }else if(ieee->modulation & IEEE80211_OFDM_MODULATION) - strcat(wrqu->name, "g"); + strlcat(wrqu->name, "g", IFNAMSIZ); if (ieee->mode & (IEEE_N_24G | IEEE_N_5G)) - strcat(wrqu->name, "/n"); + strlcat(wrqu->name, "/n", IFNAMSIZ); if((ieee->state == IEEE80211_LINKED) || (ieee->state == IEEE80211_LINKED_SCANNING)) - strcat(wrqu->name," linked"); + strlcat(wrqu->name, " link", IFNAMSIZ); else if(ieee->state != IEEE80211_NOLINK) - strcat(wrqu->name," link.."); + strlcat(wrqu->name, " .....", IFNAMSIZ); return 0; -- cgit v1.2.3