提交 c42c65c1 编写于 作者: D Dan Carpenter 提交者: John W. Linville

mwifiex: memory corruption in mwifiex_tdls_add_vht_capab()

There is a typo here because the names are confusingly similar.  The
intent was sizeof(struct ieee80211_vht_cap) (size 12) but sizeof(struct
ieee80211_ht_cap) (size 32) was used.

Anway, it's cleaner to just specify the variable instead of the type.

Fixes: 5f6d5983 ('mwifiex: add VHT support for TDLS')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
上级 0971f7d9
...@@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv, ...@@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap)); memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap));
mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band); mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band);
memcpy(pos, &vht_cap, sizeof(struct ieee80211_ht_cap)); memcpy(pos, &vht_cap, sizeof(vht_cap));
return 0; return 0;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册