Re: [PATCH] rt2x00: fix memory corruption caused by eeprom buffer overflow

"Ivo Van Doorn" <ivdoorn@xxxxxxxxx> · Mon, 19 Feb 2007 12:07:30 +0100

hi

diff --git a/drivers/net/wireless/d80211/rt2x00/rt73usb.c b/drivers/net/wireless/d80211/rt2x00/rt73usb.c
index be66e2f..6fa5a7e 100644
--- a/drivers/net/wireless/d80211/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/d80211/rt2x00/rt73usb.c
@@ -2705,7 +2705,7 @@ static int rt73usb_alloc_eeprom(struct rt2x00_dev *rt2x00dev)
         * Allocate the eeprom memory, check the eeprom width
         * and copy the entire eeprom into this allocated memory.
         */
-       rt2x00dev->eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
+       rt2x00dev->eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL * sizeof(u16));
        if (!rt2x00dev->eeprom)
                return -ENOMEM;

you might want to change this to EEPROM_SIZE * sizeof(u16). ;)

Ivo
-
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




