Commit 47dcb080 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'staging-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging fixes from Greg KH:
 "Here are two staging driver bugfixes for 4.20-rc6.

  One is a revert of a previously incorrect patch that was merged a
  while ago, and the other resolves a possible buffer overrun that was
  found by code inspection.

  Both of these have been in the linux-next tree with no reported
  issues"

* tag 'staging-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  Revert commit ef9209b6 "staging: rtl8723bs: Fix indenting errors and an off-by-one mistake in core/rtw_mlme_ext.c"
  staging: rtl8712: Fix possible buffer overrun
parents 822b7683 87e4a540
...@@ -146,7 +146,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie) ...@@ -146,7 +146,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
p = buff; p = buff;
p += sprintf(p, "ASSOCINFO(ReqIEs="); p += sprintf(p, "ASSOCINFO(ReqIEs=");
len = sec_ie[1] + 2; len = sec_ie[1] + 2;
len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1; len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
for (i = 0; i < len; i++) for (i = 0; i < len; i++)
p += sprintf(p, "%02x", sec_ie[i]); p += sprintf(p, "%02x", sec_ie[i]);
p += sprintf(p, ")"); p += sprintf(p, ")");
......
...@@ -1346,7 +1346,7 @@ sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie, ...@@ -1346,7 +1346,7 @@ sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie,
u8 *out_ie, uint in_len) u8 *out_ie, uint in_len)
{ {
u8 authmode = 0, match; u8 authmode = 0, match;
u8 sec_ie[255], uncst_oui[4], bkup_ie[255]; u8 sec_ie[IW_CUSTOM_MAX], uncst_oui[4], bkup_ie[255];
u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01}; u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
uint ielength, cnt, remove_cnt; uint ielength, cnt, remove_cnt;
int iEntry; int iEntry;
......
...@@ -1565,7 +1565,7 @@ unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame) ...@@ -1565,7 +1565,7 @@ unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame)
if (pstat->aid > 0) { if (pstat->aid > 0) {
DBG_871X(" old AID %d\n", pstat->aid); DBG_871X(" old AID %d\n", pstat->aid);
} else { } else {
for (pstat->aid = 1; pstat->aid < NUM_STA; pstat->aid++) for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
if (pstapriv->sta_aid[pstat->aid - 1] == NULL) if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment