diff options
| author | Arif Hussain <c_arifh@qca.qualcomm.com> | 2014-03-31 18:37:15 -0700 |
|---|---|---|
| committer | Akash Patel <c_akashp@qca.qualcomm.com> | 2014-04-01 09:28:47 -0700 |
| commit | 50501799f7c18929d4af29d9ff01a26c2a66c84a (patch) | |
| tree | c2e841a66acbe54cc92f620cc6d2e139da36bb82 | |
| parent | 882a2b1514bd449dd76aa91b19fbb36087148420 (diff) | |
wlan: wext.c buffer over read fix.
vos_mem_copy may over read genIeBytes
use correct length to copy
Change-Id: Ib1cd6f06548d493abc9c75bec5431fbe2ed078c2
CRs-fixed: 641369
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_wext.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c index b4f43132ae36..ac3a649ac60e 100644 --- a/CORE/HDD/src/wlan_hdd_wext.c +++ b/CORE/HDD/src/wlan_hdd_wext.c @@ -2166,7 +2166,7 @@ static int iw_get_genie(struct net_device *dev, hddLog(LOG1, "%s: failed to copy data to user buffer", __func__); return -EFAULT; } - vos_mem_copy( extra, (v_VOID_t*)genIeBytes, wrqu->data.length); + vos_mem_copy( extra, (v_VOID_t*)genIeBytes, length); wrqu->data.length = length; hddLog(LOG1,"%s: RSN IE of %d bytes returned\n", __func__, wrqu->data.length ); |