diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2014-02-14 12:03:13 +0300 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2014-02-24 15:21:53 -0500 |
| commit | c42c65c1d5863bca54e45ea25ecb24a3def29f59 (patch) | |
| tree | 2dc9085ebb56ac6266fe70406b73ba7fd4c97e81 /drivers/net/wireless/mwifiex/tdls.c | |
| parent | Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next (diff) | |
| download | linux-dev-c42c65c1d5863bca54e45ea25ecb24a3def29f59.tar.xz linux-dev-c42c65c1d5863bca54e45ea25ecb24a3def29f59.zip | |
mwifiex: memory corruption in mwifiex_tdls_add_vht_capab()
There is a typo here because the names are confusingly similar. The
intent was sizeof(struct ieee80211_vht_cap) (size 12) but sizeof(struct
ieee80211_ht_cap) (size 32) was used.
Anway, it's cleaner to just specify the variable instead of the type.
Fixes: 5f6d5983394f ('mwifiex: add VHT support for TDLS')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/mwifiex/tdls.c')
| -rw-r--r-- | drivers/net/wireless/mwifiex/tdls.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c index 5efd456af571..1ba2a16ee471 100644 --- a/drivers/net/wireless/mwifiex/tdls.c +++ b/drivers/net/wireless/mwifiex/tdls.c @@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv, memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap)); mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band); - memcpy(pos, &vht_cap, sizeof(struct ieee80211_ht_cap)); + memcpy(pos, &vht_cap, sizeof(vht_cap)); return 0; } |