浏览代码

Staging: ath6kl: fix potential buffer overflow

Off by one

Signed-off-by: Phillip Simbwa <simbwa at gmail dot com>
Signed-off-by: Vipin Mehta <vmehta@atheros.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Phillip Simbwa 14 年之前
父节点
当前提交
64911e4b13
共有 1 个文件被更改,包括 2 次插入2 次删除
  1. 2 2
      drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c

+ 2 - 2
drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c

@@ -360,8 +360,8 @@ int PSSendOps(void *arg)
         	status = 1;
         	status = 1;
         	goto complete;
         	goto complete;
     	}
     	}
-        len = (firmware->size > MAX_BDADDR_FORMAT_LENGTH)? MAX_BDADDR_FORMAT_LENGTH: firmware->size;
-	memcpy(config_bdaddr, firmware->data,len);
+	len = min(firmware->size, MAX_BDADDR_FORMAT_LENGTH - 1);
+	memcpy(config_bdaddr, firmware->data, len);
 	config_bdaddr[len] = '\0';
 	config_bdaddr[len] = '\0';
 	write_bdaddr(hdev,config_bdaddr,BDADDR_TYPE_STRING);
 	write_bdaddr(hdev,config_bdaddr,BDADDR_TYPE_STRING);
        	A_RELEASE_FIRMWARE(firmware);
        	A_RELEASE_FIRMWARE(firmware);