]> git.karo-electronics.de Git - karo-tx-linux.git/commit
wl3501_cs: min_t() cast truncates high bits
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 26 Sep 2011 06:30:40 +0000 (09:30 +0300)
committerJohn W. Linville <linville@tuxdriver.com>
Tue, 27 Sep 2011 18:36:04 +0000 (14:36 -0400)
commit2fb40577b05a869904a8fcf7098d26f3c7809644
tree8d580ce6b1814c8a0d1f66f1fd12b618d917cab6
parentf6f3def323e5d60cc2a5659533dce547c0aac5fc
wl3501_cs: min_t() cast truncates high bits

wrqu->encoding.length comes from the network administrator.  It's
size u16.  We want to limit "tocopy" to the smallest value of either
"len_keys", "wrqu->encoding.length" or 100.  But because .length
gets cast from u16 to u8 we might use a random, smaller value than
the was desired.  It's probably not very serious, but we may as well
fix it.

Btw, this is from code auditing and not from testing.  I don't know
if this affects anyone in real life.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/wl3501_cs.c