projects / unionfs-2.6.39.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 82a0114) | patch
rndis_wlan: fix buffer overflow in rndis_query_oid
authorJussi Kivilinna <jussi.kivilinna@mbnet.fi>
Sun, 22 Nov 2009 18:16:42 +0000 (20:16 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 15 Mar 2010 15:49:43 +0000 (08:49 -0700)
commitd0fe6fb19bcc6d7483c0705d5ae05c75ddfaee59
tree4b7294bb11ff512ba2c1313193838026dd148b42tree | snapshot
parent82a0114194b288ae93fa89be97c07073fafa88bdcommit | diff
rndis_wlan: fix buffer overflow in rndis_query_oid

commit c1f8ca1d837148bf061d6ffa2038366e3cf0e4d7 upstream.

rndis_query_oid overwrites *len which stores buffer size to return full size
of received command and then uses *len with memcpy to fill buffer with
command.

Ofcourse memcpy should be done before replacing buffer size.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/net/wireless/rndis_wlan.c diff | blob | history
unionfs2-2.6.39.y