[patch 46/47] mac80211: fix a buffer overrun in station debug code

Greg KH
2009-02-14T01:18:41Z

[-- Attachment #1: mac80211-fix-a-buffer-overrun-in-station-debug-code.patch --]
[-- Type: text/plain, Size: 961 bytes --]

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jianjun Kong <jianjun@zeuux.org>

commit 013cd397532e5803a1625954a884d021653da720 upstream.

net/mac80211/debugfs_sta.c
The trailing zero was written to state[4], it's out of bounds.

Signed-off-by: Jianjun Kong <jianjun@zeuux.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
net/mac80211/debugfs_sta.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -200,7 +200,7 @@ static ssize_t sta_agg_status_write(stru
/* toggle Rx aggregation command */
tid_num = tid_num - 100;
if (tid_static_rx[tid_num] == 1) {
- strcpy(state, "off ");
+ strcpy(state, "off");
ieee80211_sta_stop_rx_ba_session(dev, da, tid_num, 0,
WLAN_REASON_QSTA_REQUIRE_SETUP);
sta->ampdu_mlme.tid_state_rx[tid_num] |=