UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

iwlwifi: fix potential buffer overrun in fw name 

Fix a potential buffer overrun when creating the fw name
in drv->firmware_name by setting a maximal length to the
char array copied to it.
The maximal length is also updated to 32 rather than 25 to
keep both 32bit and 64bit alignment without requiring
padding to the struct it is in.

Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
This commit is contained in:
Liad Kaufman 2014-01-27 16:34:23 +02:00 committed by Emmanuel Grumbach
parent 034846cfd2
commit 84b0312eee
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/iwlwifi/iwl-drv.c
View File

@ -128,7 +128,7 @@ struct iwl_drv {
const struct iwl_cfg *cfg;
int fw_index; /* firmware we're trying to load */
char firmware_name[25]; /* name of firmware file to load */
char firmware_name[32]; /* name of firmware file to load */
struct completion request_firmware_complete;
@ -237,7 +237,8 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
return -ENOENT;
}
sprintf(drv->firmware_name, "%s%s%s", name_pre, tag, ".ucode");
snprintf(drv->firmware_name, sizeof(drv->firmware_name), "%s%s.ucode",
name_pre, tag);
IWL_DEBUG_INFO(drv, "attempting to load firmware %s'%s'\n",
(drv->fw_index == UCODE_EXPERIMENTAL_INDEX)