wext: avoid overlapping memcpy in compat-64 mode The second memcpy in iwe_stream_add_point() copies: * 4 bytes in 32-bit mode (sufficient for length/flags); * 8 bytes in 64-bit mode (only first 4 bytes used); * 8 bytes in 64-bit compat (overlaps with the third mempcy). To avoid problems with the third memcpy, this patch reduces the copy length to always 4 bytes = sizeof(iw_point.length) + sizeof(iw_point.flags)/ Signed-off-by: Gerrit Renker --- include/net/iw_handler.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/include/net/iw_handler.h +++ b/include/net/iw_handler.h @@ -548,9 +548,9 @@ iwe_stream_add_point(struct iw_request_info *info, char *stream, char *ends, if(likely((stream + event_len) < ends)) { iwe->len = event_len; memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN); + /* copy length and flags of iw_point */ memcpy(stream + lcp_len, - ((char *) &iwe->u) + IW_EV_POINT_OFF, - IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN); + ((char *) &iwe->u) + IW_EV_POINT_OFF, 4); memcpy(stream + point_len, extra, iwe->u.data.length); stream += event_len; }