Skip to content

Commit

Permalink
ray_cs: read past the end of the array
Browse files Browse the repository at this point in the history
"translate" should either be set or disabled.  We also use it an
offset into the framing[] array when we're generating the proc
file.  Framing looks like this:

static const char *framing[] = { "Encapsulation", "Translation" }

So when we're setting translate we need to restrict the values to
either 1 or 0 or it can an out of bounds read.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Dan Carpenter authored and John W. Linville committed Mar 6, 2013
1 parent 88cceab commit 2dcc26e
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions drivers/net/wireless/ray_cs.c
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ static int psm;
static char *essid;

/* Default to encapsulation unless translation requested */
static int translate = 1;
static bool translate = 1;

static int country = USA;

Expand Down Expand Up @@ -178,7 +178,7 @@ module_param(hop_dwell, int, 0);
module_param(beacon_period, int, 0);
module_param(psm, int, 0);
module_param(essid, charp, 0);
module_param(translate, int, 0);
module_param(translate, bool, 0);
module_param(country, int, 0);
module_param(sniffer, int, 0);
module_param(bc, int, 0);
Expand Down Expand Up @@ -1353,7 +1353,7 @@ static int ray_get_range(struct net_device *dev, struct iw_request_info *info,
static int ray_set_framing(struct net_device *dev, struct iw_request_info *info,
union iwreq_data *wrqu, char *extra)
{
translate = *(extra); /* Set framing mode */
translate = !!*(extra); /* Set framing mode */

return 0;
}
Expand Down

0 comments on commit 2dcc26e

Please sign in to comment.