From 6819bc3f16674384a757917ee59819ed4f7ebbb0 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 20 Oct 2011 09:10:39 +0300 Subject: [PATCH] --- yaml --- r: 268875 b: refs/heads/master c: 44ec5d29169426b00fe054f0a13744140de29e11 h: refs/heads/master i: 268873: 89451066fbf2aee12e6903077294711350506ddc 268871: bc1a52eaea694d234d6777adbe57e2b79d1815c9 v: v3 --- [refs] | 2 +- trunk/drivers/staging/vt6656/ioctl.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/[refs] b/[refs] index 3114dac0deab..99b10fde04ef 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 883aeecc9ddc120e34a1157aee37738a4e96b517 +refs/heads/master: 44ec5d29169426b00fe054f0a13744140de29e11 diff --git a/trunk/drivers/staging/vt6656/ioctl.c b/trunk/drivers/staging/vt6656/ioctl.c index 2cde4f0c0469..49390026dea3 100644 --- a/trunk/drivers/staging/vt6656/ioctl.c +++ b/trunk/drivers/staging/vt6656/ioctl.c @@ -81,6 +81,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) } pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid; + if (pItemSSID->len > WLAN_SSID_MAXLEN + 1) + return -EINVAL; if (pItemSSID->len != 0) { memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1); memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN); @@ -155,6 +157,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) } pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid; + if (pItemSSID->len > WLAN_SSID_MAXLEN + 1) + return -EINVAL; memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1); memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN); if (sJoinCmd.wBSSType == ADHOC) { @@ -476,6 +480,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) } pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid; + if (pItemSSID->len > WLAN_SSID_MAXLEN + 1) + return -EINVAL; memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1); memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);