From patchwork Sun Nov 22 18:16:42 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jussi Kivilinna X-Patchwork-Id: 62068 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id nAMIGjMj000938 for ; Sun, 22 Nov 2009 18:16:45 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753213AbZKVSQi (ORCPT ); Sun, 22 Nov 2009 13:16:38 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752906AbZKVSQh (ORCPT ); Sun, 22 Nov 2009 13:16:37 -0500 Received: from sinikuusama.dnainternet.net ([83.102.40.134]:60641 "EHLO sinikuusama.dnainternet.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752589AbZKVSQh (ORCPT ); Sun, 22 Nov 2009 13:16:37 -0500 Received: from localhost (localhost [127.0.0.1]) by sinikuusama.dnainternet.net (Postfix) with ESMTP id 81D772C8B8; Sun, 22 Nov 2009 20:16:42 +0200 (EET) X-Virus-Scanned: DNA Postiturva at dnainternet.net X-Spam-Flag: NO X-Spam-Score: 1.532 X-Spam-Level: * X-Spam-Status: No, score=1.532 tagged_above=-9999 required=6 tests=[AWL=-1.170, HELO_LH_HOME=2.602, RDNS_DYNAMIC=0.1] Received: from sinikuusama.dnainternet.net ([83.102.40.134]) by localhost (sinikuusama.dnainternet.net [127.0.0.1]) (amavisd-new, port 10041) with ESMTP id QKuUAldBcmn5; Sun, 22 Nov 2009 20:16:42 +0200 (EET) Received: from oliivipuu.dnainternet.net (oliivipuu.dnainternet.net [83.102.40.215]) by sinikuusama.dnainternet.net (Postfix) with ESMTP id 471282C8B4; Sun, 22 Nov 2009 20:16:42 +0200 (EET) Received: from fate.lan (dyn2-85-23-163-235.psoas.suomi.net [85.23.163.235]) by oliivipuu.dnainternet.net (Postfix) with ESMTP id 37AE07F006; Sun, 22 Nov 2009 20:16:42 +0200 (EET) From: Jussi Kivilinna Subject: [PATCH 1/2] rndis_wlan: fix buffer overflow in rndis_query_oid To: "John W. Linville" Cc: linux-wireless@vger.kernel.org Date: Sun, 22 Nov 2009 20:16:42 +0200 Message-ID: <20091122181642.24641.73461.stgit@fate.lan> User-Agent: StGIT/0.14.2 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index aa1880a..8b09b04 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -733,12 +733,13 @@ static int rndis_query_oid(struct usbnet *dev, __le32 oid, void *data, int *len) le32_to_cpu(u.get_c->status)); if (ret == 0) { + memcpy(data, u.buf + le32_to_cpu(u.get_c->offset) + 8, *len); + ret = le32_to_cpu(u.get_c->len); if (ret > *len) *len = ret; - memcpy(data, u.buf + le32_to_cpu(u.get_c->offset) + 8, *len); - ret = rndis_error_status(u.get_c->status); + ret = rndis_error_status(u.get_c->status); if (ret < 0) devdbg(dev, "rndis_query_oid(%s): device returned " "error, 0x%08x (%d)", oid_to_string(oid),