提交 707985b3 编写于 作者: D David Woodhouse 提交者: John W. Linville

[PATCH] libertas: fix big-endian associate command.

Byte-swapping length fields and then passing them to memcpy() considered
harmful.
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
上级 e5b3d472
......@@ -362,25 +362,25 @@ int libertas_cmd_80211_associate(wlan_private * priv,
ssid = (struct mrvlietypes_ssidparamset *) pos;
ssid->header.type = cpu_to_le16(TLV_TYPE_SSID);
ssid->header.len = cpu_to_le16(bss->ssid.ssidlength);
memcpy(ssid->ssid, bss->ssid.ssid, ssid->header.len);
pos += sizeof(ssid->header) + ssid->header.len;
ssid->header.len = cpu_to_le16(ssid->header.len);
tmplen = bss->ssid.ssidlength;
ssid->header.len = cpu_to_le16(tmplen);
memcpy(ssid->ssid, bss->ssid.ssid, tmplen);
pos += sizeof(ssid->header) + tmplen;
phy = (struct mrvlietypes_phyparamset *) pos;
phy->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
phy->header.len = cpu_to_le16(sizeof(phy->fh_ds.dsparamset));
tmplen = sizeof(phy->fh_ds.dsparamset);
phy->header.len = cpu_to_le16(tmplen);
memcpy(&phy->fh_ds.dsparamset,
&bss->phyparamset.dsparamset.currentchan,
sizeof(phy->fh_ds.dsparamset));
pos += sizeof(phy->header) + phy->header.len;
phy->header.len = cpu_to_le16(phy->header.len);
tmplen);
pos += sizeof(phy->header) + tmplen;
ss = (struct mrvlietypes_ssparamset *) pos;
ss->header.type = cpu_to_le16(TLV_TYPE_CF);
ss->header.len = cpu_to_le16(sizeof(ss->cf_ibss.cfparamset));
pos += sizeof(ss->header) + ss->header.len;
ss->header.len = cpu_to_le16(ss->header.len);
tmplen = sizeof(ss->cf_ibss.cfparamset);
ss->header.len = cpu_to_le16(tmplen);
pos += sizeof(ss->header) + tmplen;
rates = (struct mrvlietypes_ratesparamset *) pos;
rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册