diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-09-23 19:33:00 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-09-25 15:57:43 -0400 |
| commit | fd0fc5218dc31d446fd108a6a571702a7c9bec29 (patch) | |
| tree | d0c5e124a1b94dfad257ccca693df7bf0a2fca30 /drivers/net/wireless/mwifiex/ie.c | |
| parent | 046b6802c8d3c8a57448485513bf7291633e0fa3 (diff) | |
mwifiex: potential corruption in mwifiex_update_uap_custom_ie()
ap_custom_ie is a struct mwifiex_ie_list which is quite different and
also larger than struct mwifiex_ie. It's a difference between 4196
bytes and 262.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Stone Piao <piaoyun@marvell.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/mwifiex/ie.c')
| -rw-r--r-- | drivers/net/wireless/mwifiex/ie.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c index 1d8dd003e39..fa3a80fb8c0 100644 --- a/drivers/net/wireless/mwifiex/ie.c +++ b/drivers/net/wireless/mwifiex/ie.c @@ -160,7 +160,7 @@ mwifiex_update_uap_custom_ie(struct mwifiex_private *priv, u16 len; int ret; - ap_custom_ie = kzalloc(sizeof(struct mwifiex_ie), GFP_KERNEL); + ap_custom_ie = kzalloc(sizeof(*ap_custom_ie), GFP_KERNEL); if (!ap_custom_ie) return -ENOMEM; |