* [PATCH] nets: fix a buffer overrun
@ 2008-11-08 2:35 Jianjun Kong
2008-11-11 5:37 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Jianjun Kong @ 2008-11-08 2:35 UTC (permalink / raw)
To: linville; +Cc: Linux-Kernel-Mailing-List, netdev
net/mac80211/debugfs_sta.c
The trailing zero was written to state[4], it's out of bounds.
Signed-off-by: Jianjun Kong <jianjun@zeuux.org>
---
net/mac80211/debugfs_sta.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 189d0ba..b85c4f2 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -199,7 +199,7 @@ static ssize_t sta_agg_status_write(struct file *file,
/* toggle Rx aggregation command */
tid_num = tid_num - 100;
if (tid_static_rx[tid_num] == 1) {
- strcpy(state, "off ");
+ strcpy(state, "off");
ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
WLAN_REASON_QSTA_REQUIRE_SETUP);
sta->ampdu_mlme.tid_state_rx[tid_num] |=
--
1.5.6.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-11-11 5:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-11-08 2:35 [PATCH] nets: fix a buffer overrun Jianjun Kong
2008-11-11 5:37 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox