diff options
| author | Chen Gang <gang.chen@asianux.com> | 2013-01-08 05:33:03 (GMT) |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2013-01-22 21:01:29 (GMT) |
| commit | 708d019fd1d2d1bf184e797ebe934c90a6527d50 (patch) | |
| tree | 332a80b8f144cd0b82988ec4f7a63fb5cb769c05 | |
| parent | 6aaacd861517f89797f2f4a54624a599847262f3 (diff) | |
| download | linux-708d019fd1d2d1bf184e797ebe934c90a6527d50.tar.xz | |
drivers/net/wireless: need consider the not '\0' terminated string.
in ray_cs.c:
the a_current_ess_id is "Null terminated unless ESSID_SIZE long"
so we need buffer it with '\0' firstly, before using strlen or %s.
additional information:
in drivers/net/wireless/rayctl.h:
"NULL terminated unless 32 long" is a comment at line 616, 664
ESSID_SIZE is 32, at line 190
in include/uapi/linux/wireless.h:
IW_ESSID_MAX_SIZE is also 32
in drivers/net/wireless/ray_cs.c:
use strncpy for it, without '\0' terminated, at line 639
use memcpy for it, assume not '\0' terminated in line 1092..1097
buffer it with '\0' firstly, before using %s, in line 2576, 2598..2600
Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/ray_cs.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c index 598ca1c..e7cf37f 100644 --- a/drivers/net/wireless/ray_cs.c +++ b/drivers/net/wireless/ray_cs.c @@ -1107,12 +1107,15 @@ static int ray_get_essid(struct net_device *dev, struct iw_request_info *info, union iwreq_data *wrqu, char *extra) { ray_dev_t *local = netdev_priv(dev); + UCHAR tmp[IW_ESSID_MAX_SIZE + 1]; /* Get the essid that was set */ memcpy(extra, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE); + memcpy(tmp, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE); + tmp[IW_ESSID_MAX_SIZE] = '\0'; /* Push it out ! */ - wrqu->essid.length = strlen(extra); + wrqu->essid.length = strlen(tmp); wrqu->essid.flags = 1; /* active */ return 0; @@ -1842,6 +1845,8 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id) UCHAR tmp; UCHAR cmd; UCHAR status; + UCHAR memtmp[ESSID_SIZE + 1]; + if (dev == NULL) /* Note that we want interrupts with dev->start == 0 */ return IRQ_NONE; @@ -1901,17 +1906,21 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id) break; case CCS_START_NETWORK: case CCS_JOIN_NETWORK: + memcpy(memtmp, local->sparm.b4.a_current_ess_id, + ESSID_SIZE); + memtmp[ESSID_SIZE] = '\0'; + if (status == CCS_COMMAND_COMPLETE) { if (readb (&pccs->var.start_network.net_initiated) == 1) { dev_dbg(&link->dev, "ray_cs interrupt network \"%s\" started\n", - local->sparm.b4.a_current_ess_id); + memtmp); } else { dev_dbg(&link->dev, "ray_cs interrupt network \"%s\" joined\n", - local->sparm.b4.a_current_ess_id); + memtmp); } memcpy_fromio(&local->bss_id, pccs->var.start_network.bssid, @@ -1939,12 +1948,12 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id) if (status == CCS_START_NETWORK) { dev_dbg(&link->dev, "ray_cs interrupt network \"%s\" start failed\n", - local->sparm.b4.a_current_ess_id); + memtmp); local->timer.function = start_net; } else { dev_dbg(&link->dev, "ray_cs interrupt network \"%s\" join failed\n", - local->sparm.b4.a_current_ess_id); + memtmp); local->timer.function = join_net; } add_timer(&local->timer); |