From e65eb5cbf55a7c49ae24996975b7d811a1ef8875 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Sat, 26 Sep 2009 20:51:14 +0200
Subject: [PATCH] --- yaml --- r: 166572 b: refs/heads/master c:
 8503bd8c7dc6f82ec2de9d05e0a476e6ca5adc8b h: refs/heads/master v: v3

---
 [refs]                    | 2 +-
 trunk/net/wireless/wext.c | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/[refs] b/[refs]
index 1a230738778c..23a2ea37c136 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0ff716136ab73d2fc1edc0664e38169e7a76bb9a
+refs/heads/master: 8503bd8c7dc6f82ec2de9d05e0a476e6ca5adc8b
diff --git a/trunk/net/wireless/wext.c b/trunk/net/wireless/wext.c
index 5b4a0cee4418..ac4ac26b53ce 100644
--- a/trunk/net/wireless/wext.c
+++ b/trunk/net/wireless/wext.c
@@ -773,10 +773,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
 			essid_compat = 1;
 		else if (IW_IS_SET(cmd) && (iwp->length != 0)) {
 			char essid[IW_ESSID_MAX_SIZE + 1];
+			unsigned int len;
+			len = iwp->length * descr->token_size;
 
-			err = copy_from_user(essid, iwp->pointer,
-					     iwp->length *
-					     descr->token_size);
+			if (len > IW_ESSID_MAX_SIZE)
+				return -EFAULT;
+
+			err = copy_from_user(essid, iwp->pointer, len);
 			if (err)
 				return -EFAULT;