summaryrefslogtreecommitdiffstats
path: root/drivers/staging/rtl8712
diff options
context:
space:
mode:
authorLarry Finger <Larry.Finger@lwfinger.net>2012-11-27 12:08:44 -0600
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-11-28 08:49:21 -0800
commit8b7a13c3f404cbd26b495fa9c34339cb9b7b8164 (patch)
tree52ad2d0b5f1342665b867e9be00ea3f4ed175cde /drivers/staging/rtl8712
parent0df1a84e0ec875d1bc12ac6aca325cb3543a7ad6 (diff)
staging: r8712u: Fix possible buffer overrun
In routine r8712_report_sec_ie(), the code could set the length of the buffer to 256; however, that value is one larger than the corresponding memory allocation. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/rtl8712')
-rw-r--r--drivers/staging/rtl8712/mlme_linux.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/rtl8712/mlme_linux.c b/drivers/staging/rtl8712/mlme_linux.c
index abf96c14df9..7279854c86a 100644
--- a/drivers/staging/rtl8712/mlme_linux.c
+++ b/drivers/staging/rtl8712/mlme_linux.c
@@ -156,7 +156,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
p = buff;
p += sprintf(p, "ASSOCINFO(ReqIEs=");
len = sec_ie[1] + 2;
- len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
+ len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1;
for (i = 0; i < len; i++)
p += sprintf(p, "%02x", sec_ie[i]);
p += sprintf(p, ")");