diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2009-05-15 12:01:59 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-05-15 12:02:06 -0700 |
| commit | 3346857f6fab1d6d1237a3ec7cfa159ec9b52db5 (patch) | |
| tree | 9468318835176cdb6e51a8ec4c8c87340c080611 /drivers/net/wireless/airo.c | |
| parent | 5d41343ac88eeddd25dc4ffb7050c9095c41a70d (diff) | |
| parent | 542cc7937e6af73cb2edc455a0e456d22e254abb (diff) | |
| download | kernel-crypto-3346857f6fab1d6d1237a3ec7cfa159ec9b52db5.tar.gz kernel-crypto-3346857f6fab1d6d1237a3ec7cfa159ec9b52db5.tar.xz kernel-crypto-3346857f6fab1d6d1237a3ec7cfa159ec9b52db5.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6:
iwlwifi: fix device id registration for 6000 series 2x2 devices
ath5k: update channel in sw state after stopping RX and TX
rtl8187: use DMA-aware buffers with usb_control_msg
mac80211: avoid NULL ptr deref when finding max_rates in PID and minstrel
airo: airo_get_encode{,ext} potential buffer overflow
Pulled directly by Linus because Davem is off playing shuffle-board at
some Alaskan cruise, and the NULL ptr deref issue hits people and should
get merged sooner rather than later.
David - make us proud on the shuffle-board tournament!
Diffstat (limited to 'drivers/net/wireless/airo.c')
| -rw-r--r-- | drivers/net/wireless/airo.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c index c36d3a3d655..d7347573912 100644 --- a/drivers/net/wireless/airo.c +++ b/drivers/net/wireless/airo.c @@ -6501,7 +6501,10 @@ static int airo_get_encode(struct net_device *dev, /* Copy the key to the user buffer */ dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf)); - memcpy(extra, buf, dwrq->length); + if (dwrq->length != -1) + memcpy(extra, buf, dwrq->length); + else + dwrq->length = 0; return 0; } @@ -6659,7 +6662,10 @@ static int airo_get_encodeext(struct net_device *dev, /* Copy the key to the user buffer */ ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf)); - memcpy(extra, buf, ext->key_len); + if (ext->key_len != -1) + memcpy(extra, buf, ext->key_len); + else + ext->key_len = 0; return 0; } |