From 4cd247d19e6bb8025b0cee2ef06545b9c151a385 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes@sipsolutions.net>
Date: Wed, 13 May 2009 12:04:30 +0200
Subject: [PATCH] --- yaml --- r: 145262 b: refs/heads/master c:
 88f16db7a2fa63b9242e8a0fbc40d51722f2e2f9 h: refs/heads/master v: v3

---
 [refs]                    | 2 +-
 trunk/net/wireless/wext.c | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 6e52d9c9f32b..bc71018f0493 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 2b611cb6eed04062d0a9861c82248e02c844ba3f
+refs/heads/master: 88f16db7a2fa63b9242e8a0fbc40d51722f2e2f9
diff --git a/trunk/net/wireless/wext.c b/trunk/net/wireless/wext.c
index cb6a5bb85d80..0e59f9ae9b81 100644
--- a/trunk/net/wireless/wext.c
+++ b/trunk/net/wireless/wext.c
@@ -786,6 +786,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
 			err = -EFAULT;
 			goto out;
 		}
+
+		if (cmd == SIOCSIWENCODEEXT) {
+			struct iw_encode_ext *ee = (void *) extra;
+
+			if (iwp->length < sizeof(*ee) + ee->key_len)
+				return -EFAULT;
+		}
 	}
 
 	err = handler(dev, info, (union iwreq_data *) iwp, extra);