SOURCES: madwifi-ng-ieee80211_wireless.c.patch (NEW) - http://madw...

[mguevara]

Author: mguevara                     Date: Sat Oct 21 01:18:02 2006 GMT
Module: SOURCES                       Tag: HEAD
---- Log message:
- http://madwifi.org/ticket/946

---- Files affected:
SOURCES:
   madwifi-ng-ieee80211_wireless.c.patch (NONE -> 1.1)  (NEW)

---- Diffs:

================================================================
Index: SOURCES/madwifi-ng-ieee80211_wireless.c.patch
diff -u /dev/null SOURCES/madwifi-ng-ieee80211_wireless.c.patch:1.1
--- /dev/null	Sat Oct 21 03:18:02 2006
+++ SOURCES/madwifi-ng-ieee80211_wireless.c.patch	Sat Oct 21 03:17:57 2006
@@ -0,0 +1,27 @@
+--- madwifi-ng-r1757-20061020/net80211/ieee80211_wireless.c	2006-07-06 05:23:08.000000000 +0200
++++ madwifi-ng-r1757-20061020/net80211/ieee80211_wireless.c	2006-10-10 18:11:45.369999000 +0200
+@@ -5043,7 +5051,9 @@
+ 		return -EPERM;
+ 	if (copy_from_user(&cp, ifr->ifr_data, sizeof(cp)))
+ 		return -EFAULT;
+-
++	if (access_ok(VERIFY_WRITE, ifr->ifr_name, IFNAMSIZ))
++		return -EFAULT;
++	  
+ 	unit = ieee80211_new_wlanunit();
+ 	if (unit == -1)
+ 		return -EIO;		/* XXX */
+@@ -5054,8 +5064,11 @@
+ 		ieee80211_delete_wlanunit(unit);
+ 		return -EIO;
+ 	}
+-	/* return final device name */
+-	strncpy(ifr->ifr_name, vap->iv_dev->name, IFNAMSIZ);
++
++	/* return final device name - should not fail, we have already
++	   checked above if we can access this. */
++	if (__copy_to_user(ifr->ifr_name, vap->iv_dev->name, IFNAMSIZ))
++	        return -EFAULT;
+ 	return 0;
+ }
+ EXPORT_SYMBOL(ieee80211_ioctl_create_vap);
================================================================