[PATCH 09/12] Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME
Greg KH
greg at kroah.com
Sun Jul 12 22:45:25 UTC 2009
From: Dan Aloni <dan at aloni.org>
I repeatedly get __stack_chk_fail panic()s with this driver before
applying the attached fix.
ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.
length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17
This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.
It can be applied to 2.6.30-stable as well.
Signed-off-by: Dan Aloni <dan at aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
Cc: stable <stable at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
---
.../rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++++++------
1 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
index 93af37e..54b4b71 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
struct iw_request_info *info,
union iwreq_data *wrqu, char *extra)
{
- strcpy(wrqu->name, "802.11");
+ strlcpy(wrqu->name, "802.11", IFNAMSIZ);
if(ieee->modulation & IEEE80211_CCK_MODULATION){
- strcat(wrqu->name, "b");
+ strlcat(wrqu->name, "b", IFNAMSIZ);
if(ieee->modulation & IEEE80211_OFDM_MODULATION)
- strcat(wrqu->name, "/g");
+ strlcat(wrqu->name, "/g", IFNAMSIZ);
}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
- strcat(wrqu->name, "g");
+ strlcat(wrqu->name, "g", IFNAMSIZ);
if((ieee->state == IEEE80211_LINKED) ||
(ieee->state == IEEE80211_LINKED_SCANNING))
- strcat(wrqu->name," linked");
+ strlcat(wrqu->name," link", IFNAMSIZ);
else if(ieee->state != IEEE80211_NOLINK)
- strcat(wrqu->name," link..");
+ strlcat(wrqu->name," .....", IFNAMSIZ);
return 0;
--
1.6.3.2
More information about the devel
mailing list