drivers/net/wireless: need consider the not '\0' terminated string.
in ray_cs.c: the a_current_ess_id is "Null terminated unless ESSID_SIZE long" so we need buffer it with '\0' firstly, before using strlen or %s. additional information: in drivers/net/wireless/rayctl.h: "NULL terminated unless 32 long" is a comment at line 616, 664 ESSID_SIZE is 32, at line 190 in include/uapi/linux/wireless.h: IW_ESSID_MAX_SIZE is also 32 in drivers/net/wireless/ray_cs.c: use strncpy for it, without '\0' terminated, at line 639 use memcpy for it, assume not '\0' terminated in line 1092..1097 buffer it with '\0' firstly, before using %s, in line 2576, 2598..2600 Signed-off-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Please register or sign in to comment