From 4b02e89a23f4d5dda02585ca7e9bb05f05a691d1 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <error27@gmail.com>
Date: Sun, 20 Feb 2011 15:49:53 +0300
Subject: [PATCH] --- yaml --- r: 236085 b: refs/heads/master c:
 5b6567ee84d6e8f7015eaa7d7c4926b4fd81746e h: refs/heads/master i:   236083:
 2884337aed48fcf831455c0d32eda02d2a5344e5 v: v3

---
 [refs]                                        | 2 +-
 trunk/drivers/staging/ath6kl/os/linux/ioctl.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index bfa6f0b77223..a89fb900a686 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 253804a25b45aad7bf4f63483f7c7b1d14ab49e2
+refs/heads/master: 5b6567ee84d6e8f7015eaa7d7c4926b4fd81746e
diff --git a/trunk/drivers/staging/ath6kl/os/linux/ioctl.c b/trunk/drivers/staging/ath6kl/os/linux/ioctl.c
index 82c7611c2081..4f30b255fc1a 100644
--- a/trunk/drivers/staging/ath6kl/os/linux/ioctl.c
+++ b/trunk/drivers/staging/ath6kl/os/linux/ioctl.c
@@ -3175,6 +3175,11 @@ int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 break;
             }
 
+            if (optTxFrmCmd.optIEDataLen > MAX_OPT_DATA_LEN) {
+                ret = -EINVAL;
+                break;
+            }
+
             if (copy_from_user(data, userdata+sizeof(WMI_OPT_TX_FRAME_CMD) - 1,
                                    optTxFrmCmd.optIEDataLen)) {
                 ret = -EFAULT;