Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-16 00:52:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

[PATCH] libertas: fix big-endian associate command.

Browse Source 
Byte-swapping length fields and then passing them to memcpy() considered
harmful.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
David Woodhouse 2007-05-25 23:41:16 -04:00 committed by John W. Linville
parent e5b3d472ad
commit 707985b385
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/net/wireless/libertas/join.c
View File

@ -362,25 +362,25 @@ int libertas_cmd_80211_associate(wlan_private * priv,
ssid = (struct mrvlietypes_ssidparamset *) pos;
ssid->header.type = cpu_to_le16(TLV_TYPE_SSID);
ssid->header.len = cpu_to_le16(bss->ssid.ssidlength);
memcpy(ssid->ssid, bss->ssid.ssid, ssid->header.len);
pos += sizeof(ssid->header) + ssid->header.len;
ssid->header.len = cpu_to_le16(ssid->header.len);
tmplen = bss->ssid.ssidlength;
ssid->header.len = cpu_to_le16(tmplen);
memcpy(ssid->ssid, bss->ssid.ssid, tmplen);
pos += sizeof(ssid->header) + tmplen;
phy = (struct mrvlietypes_phyparamset *) pos;
phy->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
phy->header.len = cpu_to_le16(sizeof(phy->fh_ds.dsparamset));
tmplen = sizeof(phy->fh_ds.dsparamset);
phy->header.len = cpu_to_le16(tmplen);
memcpy(&phy->fh_ds.dsparamset,
&bss->phyparamset.dsparamset.currentchan,
sizeof(phy->fh_ds.dsparamset));
pos += sizeof(phy->header) + phy->header.len;
phy->header.len = cpu_to_le16(phy->header.len);
tmplen);
pos += sizeof(phy->header) + tmplen;
ss = (struct mrvlietypes_ssparamset *) pos;
ss->header.type = cpu_to_le16(TLV_TYPE_CF);
ss->header.len = cpu_to_le16(sizeof(ss->cf_ibss.cfparamset));
pos += sizeof(ss->header) + ss->header.len;
ss->header.len = cpu_to_le16(ss->header.len);
tmplen = sizeof(ss->cf_ibss.cfparamset);
ss->header.len = cpu_to_le16(tmplen);
pos += sizeof(ss->header) + tmplen;
rates = (struct mrvlietypes_ratesparamset *) pos;
rates->header.type = cpu_to_le16(TLV_TYPE_RATES);