On Sat, Jul 10, 2010 at 1:53 AM, Dan Carpenter <error27@xxxxxxxxx> wrote: > This test is off by one because strlen() doesn't include the NULL > terminator. > > Signed-off-by: Dan Carpenter <error27@xxxxxxxxx> > > diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c > index 8d1190c..1051268 100644 > --- a/drivers/net/wireless/prism54/isl_ioctl.c > +++ b/drivers/net/wireless/prism54/isl_ioctl.c > @@ -2067,7 +2067,7 @@ send_simple_event(islpci_private *priv, const char *str) > memptr = kmalloc(IW_CUSTOM_MAX, GFP_KERNEL); > if (!memptr) > return; > - BUG_ON(n > IW_CUSTOM_MAX); > + BUG_ON(n >= IW_CUSTOM_MAX); > wrqu.data.pointer = memptr; > wrqu.data.length = n; > strcpy(memptr, str); > send_simple_event() never passes a NULL terminated string though. What does this fix today? If nothing then better leave as-is. Luis -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
