From: Dan Carpenter Date: Mon, 28 Dec 2009 17:01:34 +0000 (+0200) Subject: Staging: otus: off by one in usbdrvwext_siwessid() X-Git-Tag: v2.6.34-rc1~10^2~1^2~238 X-Git-Url: http://git.samba.org/samba.git/?p=sfrench%2Fcifs-2.6.git;a=commitdiff_plain;h=1c7e4a7c326c916918b5a29051db4f93973e775a Staging: otus: off by one in usbdrvwext_siwessid() A 33 char ESSID is too long and it could cause a buffer overflow a couple lines below when we put a NULL terminator on the end. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/otus/ioctl.c b/drivers/staging/otus/ioctl.c index 6808e69fb354..86d93330acad 100644 --- a/drivers/staging/otus/ioctl.c +++ b/drivers/staging/otus/ioctl.c @@ -930,7 +930,7 @@ int usbdrvwext_siwessid(struct net_device *dev, return -EINVAL; if (essid->flags == 1) { - if (essid->length > (IW_ESSID_MAX_SIZE + 1)) + if (essid->length > IW_ESSID_MAX_SIZE) return -E2BIG; if (copy_from_user(&EssidBuf, essid->pointer, essid->length))